September 2017 Summaries

Artifactory has been designed to efficiently manage binaries and support packages in any format, utilizing Checksum-Based Storage for enhanced performance and security. The platform originally used SHA1 checksums to map and validate the integrity of files, but due to the discovery of a SHA1 collision by Google, Artifactory has upgraded to support SHA-256. This transition, available in the newly released JFrog Artifactory 5.5, significantly enhances security by preventing potential collision attacks that could allow one file to impersonate another. As a result, repository managers can ensure that the artifacts downloaded are authentic. While the upgrade process may vary slightly for different Artifactory setups, such as Artifactory Enterprise HA clusters, this move toward SHA-256 not only secures current operations but also sets the stage for future improvements in binary storage security based on SHA2.

File Specs in JFrog Artifactory offer a streamlined and flexible approach to managing artifact uploads and downloads, utilizing simple configurations with only two mandatory fields: source (pattern) and target. This feature allows users to leverage regex and AQL for defining complex file patterns and supports placeholders for naming artifacts. File Specs are compatible with various CI servers, including Jenkins, TeamCity, and Bamboo, as well as cloud CI servers like Travis-CI and Circle CI via JFrog CLI. In Jenkins, File Specs can be integrated into both generic and pipeline jobs, while TeamCity and Bamboo provide similar functionalities through their Artifactory plugins. The JFrog CLI further extends File Spec capabilities, enabling commands for uploading, downloading, searching, moving, copying, and deleting files using JSON files attached via the –spec option. This powerful feature offers a universal method to efficiently manage files across different environments and platforms.