You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
This is a proof of concept of different ways we can manage dependencies for software development in an airgapped environment focused on using open source tools. Scope of this issue includes just hosting/using the packages (#54 covers transfer). It could involve writing a custom tool to facilitate this. It could also involve collating multiple lightweight OSS tools together or relying on an existing monolithic OSS software repository tool. Each of the following options should be evaluate based on the criteria for success defined below.
Output of this ticket should be working proof of concept and a followup ADR.
As there are so many different programming languages, this POC will focus on only a few, common ones:
golang
javascript/typescript/npm
python/pypi
Describe the solution you'd like
Any solution that will be picked should be the following:
Performant to the end user (and scalable)
Sustainable
Have little to no impact of provenance, interaction with the repositories with package managers, etc
Positive UX
Hosted in kubernetes (for the end user interface
The text was updated successfully, but these errors were encountered:
zachariahmiller
changed the title
Spike: Investigate options for hosting and transferring software dependencies in/into airgap/egress-limited/controlled environments
Spike: Investigate options for hosting and transferring software dependencies into airgap/egress-limited/controlled environments
May 6, 2024
Racer159
changed the title
Spike: Investigate options for hosting and transferring software dependencies into airgap/egress-limited/controlled environments
Spike: Investigate options for hosting software dependencies into airgap/egress-limited/controlled environments
Jun 3, 2024
This is basically just a slightly more opinionated take on "S3 as the storage backend". We probably have to implement the package manager APIs on top of storage in any case, but picking OCI as the store has the big advantages of:
content-addressable, so you get de-duplication of blobs across all package types for free
we can use OCI artifacts/references to associate attestations like build/source provenance, scan results, etc, regardless of what is supported by the upstream package manager
Is your feature request related to a problem? Please describe.
This is a proof of concept of different ways we can manage dependencies for software development in an airgapped environment focused on using open source tools. Scope of this issue includes just hosting/using the packages (#54 covers transfer). It could involve writing a custom tool to facilitate this. It could also involve collating multiple lightweight OSS tools together or relying on an existing monolithic OSS software repository tool. Each of the following options should be evaluate based on the criteria for success defined below.
Output of this ticket should be working proof of concept and a followup ADR.
As there are so many different programming languages, this POC will focus on only a few, common ones:
Describe the solution you'd like
Any solution that will be picked should be the following:
The text was updated successfully, but these errors were encountered: