Show HN: Artifact Keeper – Open-Source Artifactory/Nexus Alternative in Rust(github.com)
65 pointsby bsgeraci6 hours ago8 comments
  • antonyh2 hours ago
    I appreciate the honesty about using Claude and the time it took to build this, and it shows how things can look when guided by someone who knows what they are doing.

    On the other hand, it also shows that it took three weeks, so why should I use this instead of building a custom toolchain myself that is optimised for what I need and actually use? Trimming away the 45+ formats to the 5 or so that matter to my project. It raises the question - is 'enterprise' software doomed in favour of a proliferation of custom built services where everybody has something unique, or is the real value in the 'support' packages and SLAs? Will devs adopt this and put 'Artifact Keeper' on their CV, or will they put 'built an artifact toolchain with Claude'?

    But then again, kudos to you for building something that can (and probably should) eat the lunch of the enterprise-grade tools that are simply unaffordable to small business, individual contractors, and underfunded teams. Truth be told, I'm not going to build my own, so this is certainly something I want to put in a sandbox and try out, and also this is inspirational and may finally convince me that I should give Claude a fair go if it's capable of being guided to create high quality output.

    • raphinou2 hours ago
      I'm impressed with the speed of development. I didn't take a look at the quality of the code though. I'm using glm a Kimi k2.5, and I have a lot of corrections to apply to the code. Is Claude that better? Or is my process bad? OP: what's your development process?
      • antonyhan hour ago
        I've not done enough Rust to truly know, but it looks reasonable from looking at the tests, a few models, some implementation code.

        It doesn't use the 'unsafe' keyword anywhere, but that's not necessarily an indicator. Uses unsafe-libyaml which is like what it sounds (a hacky port of libyaml) but is no longer maintained (archived on GH in March 2024), and may have better choices. An SBOM would highlight these dependencies better than me doing random searches through the code.

        I'm not sure I'd have put a default in the OIDC callback to localhost, that's about the only thing I've seen in a quick 5-minute skim through. I do like the comments and the lack of emojis :-)

        I too would like to know the process, if OP is willing to share.

        • bsgeraci23 minutes ago
          I have had claude go back and forth with codesimplifier agent (they developed) and a security agent.

          I think adding this to your workflow helps but you have to make sure to have end to end testing on the mind. Because some changes can break things real fast.

          My process is pretty plain outside of paying anthropic too much money a month. Only thing extra I am using is the beads currently. I was using speckit and ralph-loop but as of last week it does not seem to be needed. THink anthropic is baking some of thes tools into claude code.

      • bsgeraci25 minutes ago
        Claude is... unfortunetly... that much better. They really know how to use the tools that integrate into CLI that just makes the flow so much better.

        The only extra stuff I am doing now is beads. https://github.com/steveyegge/beads

        I was using speckit and ralph-loop but think anthropic baked in that ralph-loop. Basically a dumb while true until you break with the condition.

    • bsgeracian hour ago
      I would say do not trust it, but use it and try it. Hopefully over time I can build trust by people using it.
  • stroebs3 hours ago
    I’m a fairly heavy user of the JFrog platform with Enterprise+, Xray, their new Curation license, and my org is spending in excess of $500k/year on Artifact storage. Not including my time babysitting it. I’d love to see the end of it, and I hope you manage to build a community around this.

    Part of the reason we pay the big license fee is so we have someone to turn to when it inevitably breaks because we’ve used it in a way nobody has before. In Jan last year we were using 30TB of artifact storage in S3. That’s 140TB today.

    Where do you get your CVE data? Would built artifacts have their CVEs updated after the fact? Do you have blocking policies on artifacts based on CVEs, licenses, artifact age, etc?

    • bsgeracian hour ago
      I am using the openscap and trivia. Can you add a discussion to my github about some of this. I would love some of your feedback on what you need on your level. I need to check the update mechanism so we are keeping the database up to date. I also want a way to keep it up to date when it is airgapped, not everyones use case but one I have delt with at my jobs.

      I still need to put some e2e testing on those policies. https://demo.artifactkeeper.com/security/policies here is a demo and you can add a policy. Again that one I need to make a series of end to end testing but that was designed in mind :) I really want a staging area and promotion of packages after scans.

      On my list of things to do.

    • raphinou3 hours ago
      I looked at your profile but didn't seen any contact info, hence this comment. I'm working on a fully open source multisig solution for artifact authentication. I would be interested to have your opinion and if you see opportunities for such a project in companies as the one you work for now to make the project financially sustainable. Can you contact me? (Email in my profile)

      Edit: the project if anyone reading this is interested: http://github.com/asfaload/asfaload (looking for feedback!)

    • M0r13n3 hours ago
      JFrogs platform is fairly robust. Only time will tell if this project can keep up. I highly doubt it's more than a fancy-looking prototype at this stage
      • gjvcan hour ago
        tell me mr armchair general, what have you done that's worth talking about?
        • bsgeracian hour ago
          I think it is right to be skeptectial and I hope this project can prove people wrong.
    • moezd3 hours ago
      Unfortunately I'm also in the same camp, with SBOM generation, Xray, Curation, the whole shebang. I couldn't find these in the docs as well, which would matter in my case.
    • eyeris3 hours ago
      Since the cve data is from Trivy/Grype, that should be osv.dev
  • kamma44343 hours ago
    I have been looking for ways to only use local packages for our software builds. I am looking for something that can act as a local cache for Java and NPM packages. The idea would be that developers can only use packages belonging to the allowed set for development, and there is a vetting process where packages are added to the allowed set (or removed).

    I have been playing with the idea of using a single git repository to host them, Java packages as an Ivy repository and JavaScript packages as simply the contents of node_modules.

    Anybody does something similar?

  • figmert2 hours ago
    I've been wanting something like this that isn't artifactory (I've ran it in previous companies, it's not a great experience), so I had been thinking of doing it myself, but never bothered. One idea I had is to write a proxy that essentially translates the various package manager endpoints into OCI registry, thus causing everything to be stored on any OCI backend. My thinking was this way you could in theory use any OCI backend (including ready available, battle-tested self-hosted applications), but this proxy would never need it's own state, thus making it (hopefully) easier to run.

    Now that you've implemented, was there a reason you didn't go for such an approach so that you would worry about less as someone hosting something like this?

  • jamesvnzan hour ago
    Nice work.. I'm building the same thing right now. Partly because we need this and don't have the budget for Artifactory etc., and mainly to test out largely hands free, agentic development.
    • bsgeraci16 minutes ago
      Feel free to use what I am building but I also think more people just need to try and build something. We are almost in a star trek style world where you are talking to a computer to make a holo deck promgram :) sorry for the trekkie talk.

      My recommendation with testing out hands free agentic, know it is not fully hands free. I find my self babysitting alot of terminals going at once, like having a bunch of interns or junior devopers.

      It is important to plan plan plan.

      I want to eventually switch and play with self hosted models but for most agentic stuff Claude is killing it in terms of results.

  • burakemir4 hours ago
    Thanks for sharing.
  • jurgenburgen26 minutes ago
    [dead]
  • builderhq_io2 hours ago
    [dead]