RFD 170: Package Distribution v3 #43143
Conversation
fheinecke
added
the
no-changelog
fheinecke
requested review from
klizhentas,
r0mant,
bernardjkim,
doggydogworld and
camscale
There was a problem hiding this comment.
I don't have much feedback on whether Artifactory is the right choice or not. Sounds like it meets our requirements, but my past experience with it leaves me with the feeling that it is a slow, bloated, enterprise tool and not something that provides a nice developer experience.
| * Go modules | ||
| * We pin these currently but do not actively scan these for new/unreported | ||
| vulnerabilities | ||
| * Rust creates | ||
| * We pin these currently but do not actively scan these for new/unreported | ||
| vulnerabilities |
There was a problem hiding this comment.
We have GitHub's Dependabot security alerts and regular govulncheck runs, so I don't know if it's fair to say we don't actively scan for vulnerabilities.
There was a problem hiding this comment.
These don't check for unreported vulnerabilities, correct? My understanding (I can ask JFrog for clarification here if desired) is that JFrog's tool will look for issues in modules that have not been discovered yet/had CVE filed for yet.
Noted. When/if we demo it hosted on our own infra then I will keep this in mind. When/if I deploy a proof-of-value instance, would you like access to try it out yourself? |
rfd/0170-package-distribution-v3.md
Outdated
| tools that come included with a self-hosted JFrog license. This aligns with | ||
| our high-level objective of reducing our dependence on vendor services, | ||
| despite adding a new vendor. This includes: | ||
| * Orca (SaaS service) |
There was a problem hiding this comment.
Orca we're already removing and replacing with Wiz so it's not relevant here.
There was a problem hiding this comment.
Have we already signed with Wiz? If not, would there be value in using JFrog's solution instead of Wiz, so that we don't need another vendor?
There was a problem hiding this comment.
This is irrelevant to this RFD, Wiz implementation is already underway. Let's just remove it from scope altogether here.
Rendered