Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The GitHub registry public beta is live

help.github.com

Post reply on HN
Print view View original

51–60 of 137 posts

Re: The GitHub registry public beta is live

#51

Post by danShumway »

hn_throwaway_99 wrote: post #23
danShumway wrote: post #9

> is a software package hosting service, similar to npmjs.org, rubygems.org, or hub.docker.com, that allows you to host your packages and code in one place. You can host software packages privately or publicly and use them as dependencies in your projects. I am... really confused by this. Isn't this just Github? Github is a hosting service that allows you to host your packages and code in one place. It has testing an…

If you are familiar with Nexus or Artifactory or Verdaccio, which all essentially let you have private NPM repos (among other formats like Maven, etc.), that's what this is.

What's the difference between publishing a binary file on Artifactory and linking to a binary file in a Github release[0]?

Is Artifactory immutable? Or I guess that it handles versioning/publishing better?

[0]: https://help.github.com/en/articles/linking-to-releases

Re: The GitHub registry public beta is live

#53

Post by smudgymcscmudge »

mvanbaak wrote: post #30

Deleting packages is not supported. Sobhow to handle a compromised package? Looks like you have to contact github and hope the act fast. Oh, and no pip registry :(

Deleting was supported at initial release. Removing delete support was one of the first changes they made. My guess is that was because of the feedback they got here and on twitter.

Re: The GitHub registry public beta is live

#54

Post by craigds »

ageofwant wrote: post #48
craigds wrote: post #26

Still no python support :(

A bit disappointing yes, but pip has had support for git repo's for many years. In requirements.txt: git+ssh://git@bitbucket.org/foo/bar.git@fixit/atemp69#egg=hotshit So perhaps that's why, still would like to have a github hosted devpi

git urls are tricky to use with many tools (like pip-compile) though. At best they're slow, since things like "what's the latest version?" require downloading the repo.

We forked some things into a private DevPI instance at present for that reason (well, also for latency)

Re: The GitHub registry public beta is live

#55

Post by danShumway »

chrisseaton wrote: post #21
danShumway wrote: post #9

> is a software package hosting service, similar to npmjs.org, rubygems.org, or hub.docker.com, that allows you to host your packages and code in one place. You can host software packages privately or publicly and use them as dependencies in your projects. I am... really confused by this. Isn't this just Github? Github is a hosting service that allows you to host your packages and code in one place. It has testing an…

> what can I do now that I couldn't already do with Github as is? Before this new service how would you use GitHub as a source for installing, for example, Maven packages?

I guess I'm not sure how Maven works then -- I thought it was just downloading package binaries? I would use Github releases for that and link to the binary directly. I'd use a CI to auto-build and publish a new release binary whenever I pushed to master.

Does Maven do something more complicated like automatically figure out which platform binary to pull?

Re: The GitHub registry public beta is live

#56

Post by chrisseaton »

danShumway wrote: post #55
chrisseaton wrote: post #21

Earlier quoted context omitted.

> what can I do now that I couldn't already do with Github as is? Before this new service how would you use GitHub as a source for installing, for example, Maven packages?

I guess I'm not sure how Maven works then -- I thought it was just downloading package binaries? I would use Github releases for that and link to the binary directly. I'd use a CI to auto-build and publish a new release binary whenever I pushed to master. Does Maven do something more complicated like automatically figure out which platform binary to pull?

It's the file layout, for just one thing. You can't just point Maven (or many package managers) at a simple HTTP server without the correct layout.

If you could... they wouldn't have built this.

Re: The GitHub registry public beta is live

#57

Post by alexbecker »

hprotagonist wrote: post #6

There's no immediate mention of this on the site, but -- why did they select the package formats that they did? I'd love to be able to host wheels for my python projects, or {rpm, deb, flatpack, etc...} for effectively arbitrary code. Is that in the works?

Running a python package registry has some unique challenges, so it makes sense not to start with it (I run such a registry: https://pydist.com).

For example, Python has a distinction between distributions (the actual file downloaded, e.g. a tarfile or a manylinux1 wheel) and versions that doesn't exist in most other languages.

Re: The GitHub registry public beta is live

#58

Post by WatchDog »

danShumway wrote: post #51
hn_throwaway_99 wrote: post #23

Earlier quoted context omitted.

If you are familiar with Nexus or Artifactory or Verdaccio, which all essentially let you have private NPM repos (among other formats like Maven, etc.), that's what this is.

What's the difference between publishing a binary file on Artifactory and linking to a binary file in a Github release[0]? Is Artifactory immutable? Or I guess that it handles versioning/publishing better? [0]: https://help.github.com/en/articles/linking-to-releases

Each dependency management tool has their own nuances about how artifacts should be uploaded, and retrieved and what metadata should be stored along side them.

Re: The GitHub registry public beta is live

#59

Post by danShumway »

chrisseaton wrote: post #56
danShumway wrote: post #55

Earlier quoted context omitted.

I guess I'm not sure how Maven works then -- I thought it was just downloading package binaries? I would use Github releases for that and link to the binary directly. I'd use a CI to auto-build and publish a new release binary whenever I pushed to master. Does Maven do something more complicated like automatically figure out which platform binary to pull?

It's the file layout, for just one thing. You can't just point Maven (or many package managers) at a simple HTTP server without the correct layout. If you could... they wouldn't have built this.

Can't you? http://repo.maven.apache.org/maven2/ looks a lot to me like a simple HTTP server.

I'll take your word on it though. I don't know much about how Java package management works, and like you said, I assume the Github team wouldn't waste their time building something that wasn't necessary.

I guess if nothing else it would be a pain in the neck to have to know in advance how release files had to be laid out.

Re: The GitHub registry public beta is live

#60

Post by juliusmusseau »

bad_user wrote: post #28
matharmin wrote: post #18

Earlier quoted context omitted.

In my experience, using git as a dependency source for NPM (including yarn) or Ruby never worked well. It works for a simple case, but it's usually much slower, has issues around managing credentials for private repos, and doesn't have a nice way to publish built files.

Also, most importantly, Git repositories are not immutable and any package repo that's not immutable is a terrible, terrible idea

Copyright law prevents package repos from being truly immutable.

Fortunately a copyright takedown request is not a typical scenario, but it does happen, even with "immutable" repositories like maven-central.

Post reply on HN