41–50 of 92 posts
Earlier quoted context omitted.
What's the purpose of intermediate packages if you're already using containers?
Very large c++/python/cuda application that is packed into various different images (squashfs images, but functionally the same). We end up having a lot of libraries that are shared across multiple images.
This has been a fairly obvious service that has been missing for a while, nice to see them provide a solution. Most dependency management tools have some kind of hacky support for using S3 directly. Full fledged artifact management tools like Artifactory and Nexus support S3 backed storage. Interesting to see that the pricing is approximately double that of S3, for what I imagine is not much more than a thin layer on…
> Interesting to see that the pricing is approximately double that of S3, for what I imagine is not much more than a thin layer on top of it. Haven’t looked carefully, but is there a difference in the guarantees it provides? Might be a performance or SLA difference.
Earlier quoted context omitted.
I could not disagree more re. the expiring credentials. It is a bad practice to have credentials that never expire, especially on developer laptops, especially credentials of this nature. Developers frequently store this stuff in plain text in their home directory or as environment variables. That's a huge security risk! This service manages the process of generating and expiring credentials automatically, which is a…
> Developers frequently store this stuff in plain text in their home directory or as environment variables If you care about the security of these artifacts, why is their home directory (or their full disk) not encrypted? If they have access to the repository, they probably have artifacts downloaded on their laptops, so if the laptop is compromised, the artifacts are compromised anyway. Edit: Not saying temporary cre…
The problem is that your home directory is accessible to a ton of apps on your computer, and you have no idea what each of them is doing with that access. You also have no idea if any of them can be / are being exploited. The most recent case being Zoom – if that server they had running on localhost and responding to anyone on the laptop had file system access APIs (which is reasonable if Zoom had offered file sharing on calls) an attacker would have been able to read all your credentials.
Also the lack of nuget is a major issue.
Earlier quoted context omitted.
> Developers frequently store this stuff in plain text in their home directory or as environment variables If you care about the security of these artifacts, why is their home directory (or their full disk) not encrypted? If they have access to the repository, they probably have artifacts downloaded on their laptops, so if the laptop is compromised, the artifacts are compromised anyway. Edit: Not saying temporary cre…
The problem isn't encryption, let's assume everyone has full disk encryption turned on, so someone who steals your laptop can't access your data. The problem is that your home directory is accessible to a ton of apps on your computer, and you have no idea what each of them is doing with that access. You also have no idea if any of them can be / are being exploited. The most recent case being Zoom – if that server the…
Is it just me or is this missing plain artifacts - those that are not packaged for a specific tool? I'm thinking of plain binaries and resources required for things like db build tools and automated testing tools - just files really. How do I publish a tarball up to this, for example? Also the lack of nuget is a major issue.
Out of curiosity, what would you want from this service for the "plain binary" use-case when S3 already exists?
Is it just me or is this missing plain artifacts - those that are not packaged for a specific tool? I'm thinking of plain binaries and resources required for things like db build tools and automated testing tools - just files really. How do I publish a tarball up to this, for example? Also the lack of nuget is a major issue.
I think CodeArtifact loses value when you aren't using a package manager; the benefit is an api-compatible service with various controls and audits built on top. Out of curiosity, what would you want from this service for the "plain binary" use-case when S3 already exists?
The login credentials expire after 12 hours (or less)[1], just like with their Docker registry (ECR). That makes it pretty annoying to use, especially on developer laptops. GCP has a similar offering[2]. And GitHub[3]. [1] https://docs.aws.amazon.com/codeartifact/latest/ug/python-co... [2] https://cloud.google.com/artifact-registry [3] https://github.com/features/packages
Earlier quoted context omitted.
I think CodeArtifact loses value when you aren't using a package manager; the benefit is an api-compatible service with various controls and audits built on top. Out of curiosity, what would you want from this service for the "plain binary" use-case when S3 already exists?
It’s nice having the metadata around the push available versus raw blobs to s3.
It's not advertised in the documentation, but HeadObject(Bucket, Key)['Metadata'] is a neat dictionary of custom values.
0: https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadObje...