Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Package Registry

github.com

Post reply on HN
Print view View original

301–310 of 389 posts

Re: GitHub Package Registry

#301

Post by orthoxerox »

keytarsolo wrote: post #289
franky47 wrote: post #54

While the technical side of the news is interesting, the organisational repercussions worry me. Microsoft (who owns GitHub) is already one of the largest tech companies, and I would not be surprised if this move was intended to weaken NPM and Docker in an attempt to acquire them. I fear a future where everything one requires to develop "socially" depends on a single super-entity. GitHub and VSCode were the first step…

I'm glad you brought up Docker, but I think this is a move against GitLab, more than it is against NPM or Docker. Lots of us use GitLab at work because it's such a complete product. Source code, container registry, CI/CD, Issues (via GitLab or Jira), Maven repository, NPM repository, etc. etc. Microsoft is trying to build out GitHub so that they can more effectively compete for GitLab's corporate customers. Since buy…

The price of self-hosted GitHub was so high the last time I checked that you could buy the whole Atlassian stack or the highest tier of GitLab instead and still have enough money left for Artifactory.

Re: GitHub Package Registry

#302

Post by losvedir »

OJFord wrote: post #143
dend wrote: post #138

Earlier quoted context omitted.

docs.microsoft.com PM here - thanks for the feedback! It takes some time to update all our search results across the two major search engines. Given that some pages have less traction than others, the more obscure content sometimes still is indexed as if it's coming from MSDN. We have moved most of the library to docs, with redirects in place, so hopefully you won't get too many 404s. If you do - feel free to report…

> the two major search engines What's the second major search engine? I'm genuinely asking, not meaning to poke if it's Bing - I use DDG but just don't have a feel at all for what's most popular after the obvious one. Wikipedia has just 7% market share left for the second, and the rest - thinking about it's probably one that's popular in China and unheard of elsewhere?

DDG is just Bing, so when Bing updates its results so will DDG.

Re: GitHub Package Registry

#303

Post by andreineculau »

jeremiahlee wrote: post #293

I agree the artifacts should live alongside the code that produced them. But doesn’t Github killing npm, Inc. and Docker, Inc. in one move indicate Github is too powerful and, therefore, a huge liability? We need decentralized solutions, not another monopoly.

100% agree with you.

Take the JS world for instance, npm is many good&bad things, but one thing that was squeezed in the package.json spec is the ability to install packages from git repositories. And so, github already had a "package registry" for npm, and we publish npm packages to github without needing extra credentials, etc.

Granted npm could add a command "publish-to-git", or allow setting the repository to a github url, but a simple tool like https://github.com/andreineculau/npm-publish-git does the job (it's regularly used and tested within my current company TobiiPro https://github.com/tobiipro).

Re: GitHub Package Registry

#304

Post by diggan »

lewisjoe wrote: post #300
diggan wrote: post #283

It's a really nice project overall, having a registry that supports many different projects and run by a company that today is good, is always nice. But we been here before. We trusted npm and now they are trying to squeeze out a profit, and it ruins it for the users. I'm happy to be proven wrong, but every for-profit company that runs a package registry, eventually stagnates, and ends up implementing things that are…

First of all, thank you for building something like this. I like the idea of a decentralized, open registry. That said, the market's moving towards a universal registry for package management, across tech - npm, docker, linux packages, jars etc. With that perspective, GitLab's initiative ( https://about.gitlab.com/direction/package/ ) is something I'd likely prefer. The software's open-source and deployable, which me…

Thanks a lot, always nice to hear people like it!

Yes, I agree with you. Open-Registry isn't tied to being just a JS registry. Open-Registry focuses it's energy on unlocking the for-profit registries first though, like npm, docker and packagist, before we'd consider moving on to other already non-profit registries. Currently, there are no plans regarding expanding it, but it wouldn't be very hard and the architecture of the application makes it very easy to expand too.

While GitLabs effort is (in my mind) more well-meant than GitHubs, since it's open source, I don't think having the software open source is enough. The full development, funding and finance has to be open as well, and I don't think GitLab fits that. Basically, we need Open Source Public Utilities for core infrastructure projects like these.

Edit: Also, opened a issue in Open-Registry regarding implementing support for more package registries here: https://github.com/open-services/open-registry/issues/34

Please chime in if you think there are other registries out there than needs to be supported by more than a for-profit entity.

Re: GitHub Package Registry

#305

Post by twodave »

flunhat wrote: post #93
jackfoxy wrote: post #33

Earlier quoted context omitted.

Pure speculation, it would not surprise me to wake up someday and see MS has bought Stackoverflow. Given their direction of integrating the entire developer experience, it would make sense. MS is upgrading technical docs across the board, organizing and linking to SO content would make sense.

In light of StackOverflow looking for a new CEO, layoffs in the past year and a half, $68 million in venture capital looking for a return, and Joel Spolsky's connections to Microsoft, this might actually happen. I've also gotten the impression that StackOverflow's recruiting product isn't doing so well. It seems to be a few hundred dollars a month for a single job posting, but the results for recruiters are apparentl…

You might say StackOverflow careers isn’t doing well, but it is literally the only jobs listing outside of this website that I look at. The ability to get a succinct email within a chosen SALARY RANGE and being able to select remote only is AWESOME.

Re: GitHub Package Registry

#306

Post by andreineculau »

michaelsbradley wrote: post #97
sorahn wrote: post #25

Earlier quoted context omitted.

If you can just point at the github registry, and run `npm publish`, does that really solve the problem? NPM's major problem is there's no official link between the package and the repo, any code/branch can be published, and unless I'm missing something, this doesn't really solve that issue.

There can be a link, if you prefer to write your dependencies down that way in package.json. See Git URLs ¹ and GitHub URLs ². There are some challenges, though. If the repository requires a build step to derive a package from it then the author has to provide the proper package.json lifecycle hooks, e.g. a prepare script. Also, there's presently no git/hub-install support for a package nested inside a monorepo. ¹ ht…

Not big challenges though.

A simple tool like https://github.com/andreineculau/npm-publish-git does the job (it's regularly used and tested within my current company TobiiPro https://github.com/tobiipro).

We publish npm packages to git tags that get installed exactly the same as packages received from a registry, no build step necessary.

Re: GitHub Package Registry

#307

Post by jermo »

ccleve wrote: post #31

This is really outstanding. It will mean the death of Maven Central, about which I have mixed feelings. On the one hand, Sonatype deserves enormous thanks for what they have done for the open source world, as does mvnrepository.org. Their central repository has been free and maintained for a long time. Thank you, Sonatype. On the other hand, it took me three days to release a new version of one of my artifacts the ot…

Disagree about being the death of Maven Central - they are different beasts.

- Central has a global namespace of artifacts. com.google.guava is the same for everyone. This will probably stay the default of open-source libraries.

- GitHub Package Registry has a per-user maven repository, so a local namespace (https://maven.pkg.github.com/OWNER). This is likely to be used by companies internally.

In order to use GH Registry instead of Central, I would have to add a dozen maven repositories to my settings.xml. I doubt many developers will be up for that.

Docs: https://help.github.com/en/articles/configuring-maven-for-us...

Re: GitHub Package Registry

#308

Post by jermo »

Seems like the Maven registry is susceptible to artifact hijacking.

Say I wan't to install artifacts from two GitHub users. I would have to add these two Maven repositories:

    - https://maven.pkg.github.com/USER1 
    - https://maven.pkg.github.com/USER2
In that case USER1 can publish an artifact with the same groupId/artifactId as USER2 and my Maven will happily install it without suspecting anything.

Another case - someone deletes their GH account and another user takes it: https://blog.sonatype.com/hijacking-of-a-known-github-id-go-...

Docs: https://help.github.com/en/articles/configuring-maven-for-us...

Re: GitHub Package Registry

#309

Post by AsyncAwait »

diggan wrote: post #283

It's a really nice project overall, having a registry that supports many different projects and run by a company that today is good, is always nice. But we been here before. We trusted npm and now they are trying to squeeze out a profit, and it ruins it for the users. I'm happy to be proven wrong, but every for-profit company that runs a package registry, eventually stagnates, and ends up implementing things that are…

Hey, love projects like yours, keep it up!

Re: GitHub Package Registry

#310

Post by gmueckl »

orthoxerox wrote: post #301
keytarsolo wrote: post #289

Earlier quoted context omitted.

I'm glad you brought up Docker, but I think this is a move against GitLab, more than it is against NPM or Docker. Lots of us use GitLab at work because it's such a complete product. Source code, container registry, CI/CD, Issues (via GitLab or Jira), Maven repository, NPM repository, etc. etc. Microsoft is trying to build out GitHub so that they can more effectively compete for GitLab's corporate customers. Since buy…

The price of self-hosted GitHub was so high the last time I checked that you could buy the whole Atlassian stack or the highest tier of GitLab instead and still have enough money left for Artifactory.

I guess that's their way of telling your bean counters that you don't want self-hosted and instead want to put everything on their servers (). That way, they can increase lock in.
Post reply on HN