This is super cool, but I worry that we've basically let a proprietary closed-source service be the de-facto standard for open source software. That really hampers my enthusiasm here.
GitHub Package Registry
41–50 of 389 posts
Re: GitHub Package Registry
#42This is big. For a while we have needed a simple, intuitive and centralized artifact storage system for the modern age. I’ve been wanting to build something for ages but never made the time.
I also think that this will also have the side effect of exposing a lot of people to package/build/dist tools from other ecosystems, which might help disseminate best practices outside of their walled gardens. Github helped do this with code, helping to put the spotlight on less popular or more cutting-edge languages
This is going to solve a lot of problems for a lot of people.
Re: GitHub Package Registry
#43So... does this basically put Gemfury out of business?
Re: GitHub Package Registry
#44Do I want to use Github for this? I kind of like the npm model where they say "don't cache it, we guarantee as much capacity as you want to re-download packages". I use a lot of go modules, and each of our container builds ends up fetching them all. Github rate limits this and you have to either vendor the modules or provide a caching go module proxy (Athens, etc.). Meanwhile, npm just uses Cloudflare which seems happy to serve as many requests as I desire.
In general, I find that caching/vendoring dependencies is the most sane thing to do, but it's not what, say, the Javascript world appears to be doing. Do we want to move towards a service that already rate-limits package fetches when we already have a service that doesn't?
Re: GitHub Package Registry
#45I'm disappointed it doesn't support Python. There's not a lot of options available for private Python package hosting, it would have been good to have another one.
Re: GitHub Package Registry
#46It's always odd to me that PHP is left out of things like this. What do these other package managers have that Composer doesn't?
Re: GitHub Package Registry
#47GitHub is coming after GitLab :D They first started with Boards, then Github Actions and now with this.
What does Gitlab have that this is competing with? I know Gitlab's docker registry but not of a package registry.
Yes, it has a package registry feature for NPM and Maven:
Maven: https://docs.gitlab.com/ee/user/project/packages/maven_repos...
NPM: https://docs.gitlab.com/ee/user/project/packages/npm_registr...
Re: GitHub Package Registry
#48[flagged]
Re: GitHub Package Registry
#49Looks like Docker, node/npm, ruby/gems, java/maven, and nuget... but no Python? Seems an odd choice for the one to leave out.
Bit like security alerts which were initially just JS and Ruby. Indeed odd.
Re: GitHub Package Registry
#50Is there a way I could let some CI service like Travis CI to ONLY publish the packages to this GitHub Package Registry? ONLY means I don't want to expose the entire GitHub account to Travis CI but allow only publishing to the registry. So if the GitHub key/access-token leaks somehow the possible damage would be limited by registry publishing scope. So something like scoped access tokens.