Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Package Registry

github.com

Post reply on HN
Print view View original

91–100 of 389 posts

Re: GitHub Package Registry

#91

Post by paulddraper »

mceachen wrote: post #34

Doesn't this bifurcate the namespace of literally every packaging system they are supporting, or are they requiring `@author/`-namespaced package names? In the livestream he pokes around a github repo, sees it's one author, and decides that what makes it trustworthy? No GPG signing? The new Actions support (about 50 minutes into the live stream) for auto-publishing from master is pretty sweet. From the very cursory d…

> Doesn't this bifurcate the namespace of literally every packaging system they are supporting

No. Unless you consider the URL the namespace, but it's not.

E.g. I can download the deb "vscode" from https://packages.microsoft.com/repos/vscode

Or I could download that it from a GitHub-user controlled URL, or someone's random website. The name of the package is still "vscode", regardless of what location it was fetched from.

Re: GitHub Package Registry

#92

Post by tkahnoski »

franky47 wrote: post #54

While the technical side of the news is interesting, the organisational repercussions worry me. Microsoft (who owns GitHub) is already one of the largest tech companies, and I would not be surprised if this move was intended to weaken NPM and Docker in an attempt to acquire them. I fear a future where everything one requires to develop "socially" depends on a single super-entity. GitHub and VSCode were the first step…

Microsoft has been in this game for a while with Visual Studio, TFS, and other tools. The same strategy is just now catching up to a larget set of better tools.

IBM I believe tried to do this with their 'Rational' tool line and they're still buying into the game (UrbanCode).

Re: GitHub Package Registry

#93

Post by flunhat »

jackfoxy wrote: post #33
gigatexal wrote: post #14

This is pretty interesting. Github really is becoming the social network that MS never seemed to be able to create. We already use it as our portfolio of work for potential employers. We collaborate with fellow enthusiasts and maybe even make new friends. We host our websites from it. Abuse it to store binaries, too. And now, along side, source code we can use it as a CDN of sorts to serve packages, for free, sounds…

Pure speculation, it would not surprise me to wake up someday and see MS has bought Stackoverflow. Given their direction of integrating the entire developer experience, it would make sense. MS is upgrading technical docs across the board, organizing and linking to SO content would make sense.

In light of StackOverflow looking for a new CEO, layoffs in the past year and a half, $68 million in venture capital looking for a return, and Joel Spolsky's connections to Microsoft, this might actually happen.

I've also gotten the impression that StackOverflow's recruiting product isn't doing so well. It seems to be a few hundred dollars a month for a single job posting, but the results for recruiters are apparently mixed.

Re: GitHub Package Registry

#94

Post by symlinkk »

brazzledazzle wrote: post #82
hn_throwaway_99 wrote: post #19

This is going to be a huge hit for things like NPM Enterprise and Artifactory. Especially useful for small/medium teams that's want to start from the get-go with an easy way to share modules that will scale as they grow.

Maybe for their SaaS but we’ll see how it’s implemented in GitHub Enterprise for on-prem. If it’s anything like LFS you’ll just be expected to keep growing your volume instead of doing something sane like supporting s3 or hell, even separate volumes.

What's the point in running on-prem if you're just going to store large files in S3 anyway? It makes perfect sense the way they decided on.

Re: GitHub Package Registry

#96

Post by jackfoxy »

Nullabillity wrote: post #74
jackfoxy wrote: post #33

Earlier quoted context omitted.

Pure speculation, it would not surprise me to wake up someday and see MS has bought Stackoverflow. Given their direction of integrating the entire developer experience, it would make sense. MS is upgrading technical docs across the board, organizing and linking to SO content would make sense.

Have we been reading the same MSDN?

It is still really unorganized in many ways. The worst thing, I think, is search results still frequently list obsolete MSDN pages higher...and, btw, the new branding is not MSDN, but docs.microsoft.com. They still have a long ways to go, with the typical problems of a large organization tackling a large, kind of amorphous, project.

Re: GitHub Package Registry

#97

Post by michaelsbradley »

sorahn wrote: post #25
selrond wrote: post #13

This could solve the trust issues with npm - you never know, whether the package you're installing is really from the source provided on its npm page

If you can just point at the github registry, and run `npm publish`, does that really solve the problem? NPM's major problem is there's no official link between the package and the repo, any code/branch can be published, and unless I'm missing something, this doesn't really solve that issue.

There can be a link, if you prefer to write your dependencies down that way in package.json. See Git URLs¹ and GitHub URLs².

There are some challenges, though. If the repository requires a build step to derive a package from it then the author has to provide the proper package.json lifecycle hooks, e.g. a prepare script. Also, there's presently no git/hub-install support for a package nested inside a monorepo.

¹ https://docs.npmjs.com/files/package.json#git-urls-as-depend...

² https://docs.npmjs.com/files/package.json#github-urls

Re: GitHub Package Registry

#98

Post by djsumdog »

kevinherron wrote: post #85
ccleve wrote: post #31

This is really outstanding. It will mean the death of Maven Central, about which I have mixed feelings. On the one hand, Sonatype deserves enormous thanks for what they have done for the open source world, as does mvnrepository.org. Their central repository has been free and maintained for a long time. Thank you, Sonatype. On the other hand, it took me three days to release a new version of one of my artifacts the ot…

I'm not convinced this means the death of Maven Central, but I'll start publishing to both either way.

Yea same here. There are way too many workflows already setup around Maven Central. People publish to it from Scala/SBT, Gradle, Clojure/Leiningen, Kotlin, etc. It's not going to be going anywhere any time soon.

Re: GitHub Package Registry

#99

Post by djsumdog »

paulddraper wrote: post #68
ccleve wrote: post #31

This is really outstanding. It will mean the death of Maven Central, about which I have mixed feelings. On the one hand, Sonatype deserves enormous thanks for what they have done for the open source world, as does mvnrepository.org. Their central repository has been free and maintained for a long time. Thank you, Sonatype. On the other hand, it took me three days to release a new version of one of my artifacts the ot…

Have you tried Bintray? [1] It's made by JFrog (makers of Artifactory), it's been around for while, it supports lots of formats including harder ones like apt, and it makes package distribution about as easy as it can be. [1] https://bintray.com/

I tried it years ago and it didn't offer signed packages at the time. I ended up just using ansible to build my own rpm/deb repos on a server given to us by a University:

https://github.com/BigSense/vSense/tree/master/ansible/roles...

Re: GitHub Package Registry

#100

Post by 15characterslon »

mceachen wrote: post #34

Doesn't this bifurcate the namespace of literally every packaging system they are supporting, or are they requiring `@author/`-namespaced package names? In the livestream he pokes around a github repo, sees it's one author, and decides that what makes it trustworthy? No GPG signing? The new Actions support (about 50 minutes into the live stream) for auto-publishing from master is pretty sweet. From the very cursory d…

GitHub Actions are pretty neat. They were announced last year and I've started using them a few months ago.

You can sign up for the beta here: https://github.com/features/actions

Introduction: https://www.youtube.com/watch?v=_yPml1iTbmM

I'm a little bit anxious because the pricing has not yet been published. Both GitHub Actions and package registry will be free for public repositories but it is not yet known how much it will cost for private repositories after the beta.

Post reply on HN