5

Considering your first paragraph, the organization you're describing is a highly siloed org, which is exactly what a DevOps organization tend to avoid. Considering this challenge, within DevOps there is a requirement to define and document all the components that constitute the various technology stacks within an IT environment. Traditionally this ...


5

This turns out to be a known issue: The require_in requisite does not support everything that require does, mainly id does not support sls or state_id without specifying a state module. So by modifying our SLS file to include the state module (specifying file: /root/b as the require_in target instead of simply /root/b), we get the correct result. I don'...


4

This templated SLS file works splendidly: {% if 'components' in salt.pillar.items() %} include: {% for component in salt.pillar.get('components').keys() %} - {{ component }} {% endfor %} {% endif %} However, it requires changing my pillar key structure. From the original question, you see the structure as: my-minion-id: ---------- components: ...


4

Saved bandwith and faster downloads: Artifactory stores the artifacts that are downloaded from maven central. So if another developer needs the same dependencies they don't need to be downloaded again from maven central but instead they can be delivered from the local artifactory instance. This makes downloading faster because company networks are usualy ...


3

Any organization that needs the level of control you've specified is essentially forced into the preapproval process ("walled garden"). It's a pain for developers, but it's a necessary process to keep the company safe. I've even heard of companies with programs that scan all their workstations regularly to find and remove unapproved software. It's worth ...


3

You can also do it like: {% if pillar['components'] is defined %} include: {% for component in pillar['components'] %} - {{ component }} {% endfor %} {% endif %} {% if pillar['components'] is defined %} components: require: {% for component in pillar['components'] %} - {{ component }} {% endfor %} {% endif %}


2

There are enterprise tools that manage these opensource dependencies namely Jfrog Artifactory with the Xray feature and Inedo ProGet with features for license filtering and vulnerability scanning. Basically, allows you to restrict or permit download of package so companies can set policies to ensure development isn't breaking rights of use or building ...


2

Docker is going to be far more well-known than Mock. I consistently see Docker used during build in companies that I work for. I think I have seen Mock before, but only because I am a Fedora user. However, Docker is not a build tool in of itself, so you can still use Mock inside a container. This is a great way to avoid the "snowflake" build server. By ...


2

What could be a feasible way to motivate Maven and repository makers to establish some kind of early time warning, like issue special headers on download, or and additionally for example reject download of vulnerable components by default? Your concern, i.e. the meat of your question is a very valid one: how to improve security when downloading "stuff" from ...


2

Dependabot and npm audit both poll the Node Security Working Group database for Node-based projects. However, Dependabot has the added ability to check dependencies in numerous other types of projects as well. Also, each report Dependabot generates includes useful info and links directly to a GitHub Advisory Database listing (e.g., CVE-2017-16021) that ...


1

I resolved the problem publishing the ivy.xml file to nexus too, adding publishivy="true" to my publishing task in my build.xml file.


1

According to this page, the hosted agent supports NuGet, npm, and Maven. It looks like it might also support pip. You could install cget using pip and then use cget to install your package. A bit of a roundabout way, but it might do what you need. "C:\Program Files\Python36\Scripts\pip" install cget cget install nlohmann/json I don't have a way to test ...


1

First of all there is one Maven central repository and that is Maven central. The website mvnrepository.com is just a search engine for Maven central. Secondly there is a gazillion of paid services that already scan artifacts for you and allow you to know about known vulnerabilities beforehand. So that problem is already solved. Finally several people who ...


Only top voted, non community-wiki answers of a minimum length are eligible