September 2018 Summaries

Cloud-based hosting has become a standard in the tech industry due to its flexibility, cost-efficiency, and ease of maintenance, which allow development teams more time to focus on application development. JFrog Artifactory can be deployed on major cloud platforms, including Google Cloud Platform (GCP), either as a standalone setup or in a High Availability (HA) configuration. The setup involves three main components: networking, application, and storage. Networking requires configuring a Virtual Private Cloud (VPC), subnets, firewall rules, and virtual machines according to the specific needs of standalone or HA installations. The application component includes the Artifactory instance, reverse proxy, and a Google Cloud Load Balancer, which efficiently distributes incoming requests. Storage involves using Google Cloud Storage for binaries and a database for metadata management. For those who prefer not to handle the complex configuration process, JFrog Artifactory is also available as a cloud-native hosted service on GCP, offering subscription options for either a multi-tenanted configuration or a fully dedicated server, with the possibility of starting with a free trial.

Artifactory, a repository manager crucial for CI/CD pipelines, now supports webhooks, allowing for enhanced automation by triggering notifications based on predefined events. A webhook consists of a triggering event, the event's data payload, and a listening web location, enabling seamless communication between teams, such as notifying a build server when a new Docker tag is available. This setup eliminates the need for manual intervention across teams, which may use different servers or be geographically dispersed. Artifactory's webhook functionality is facilitated by a versatile plugin available on GitHub, offering numerous configuration options and the ability to customize with Groovy code. Installation is straightforward, requiring no restart of Artifactory, with the reload plugins API call available for updates. In addition to automating CI/CD tasks, webhooks can enhance human workflows, such as sending notifications to a Slack channel when a new build is published or alerting users to changes in protected repositories.

The blog post co-authored by Jonathan Roquelaure of JFrog and Fabrice Bellingard of SonarSource discusses the integration of Artifactory and SonarQube to enhance software quality management within CI/CD pipelines. By adding scripts to the pipeline, users can automate artifact promotion decisions based on SonarQube's quality gate results, reducing manual interventions and enhancing workflow efficiency. The authors emphasize the importance of non-blocking, customizable solutions using webhooks, APIs, and user plugins to allow seamless communication between SonarQube and Artifactory. They illustrate how webhooks notify Artifactory about quality gate statuses, enabling automated artifact handling through user plugins in Artifactory Pro and Enterprise. The post also highlights the role of Jenkins in linking SonarQube analysis with Artifactory build information, providing quick feedback to developers through commit builds and staging workflows. The collaboration between SonarSource and JFrog aims to empower development teams by offering a robust integration that supports continuous quality assurance, with an invitation to engage with the integration via a webinar and GitHub project.

As businesses increasingly adopt multicloud strategies to optimize performance, cost savings, and flexibility, they often distribute their IT resources across multiple public cloud providers rather than relying on a single service. This approach allows enterprises to maximize the strengths of different cloud platforms, such as scalability and security, while avoiding vendor lock-in and integrating different systems following mergers or acquisitions. A survey by Forrester Consulting revealed that 86 percent of cloud technology decision-makers describe their strategy as multicloud, with some using four or more public clouds. JFrog Artifactory supports this trend by enabling seamless DevOps processes across various cloud environments, allowing developers to work with open-source APIs to ensure application deployments are efficient and adaptable to different clouds. Artifactory's integration with major platforms like Google Cloud, Amazon AWS, and Microsoft Azure facilitates smooth operations, while container orchestration tools like Kubernetes further enhance multicloud deployments. By leveraging Artifactory, enterprises can maintain consistency and reliability across their cloud destinations, making it a valuable tool for those looking to implement or improve their multicloud strategies.

During a visit to Atlassian's Bitbucket Cloud Dev Week, the author developed a new JFrog Artifactory integration plugin that enhances Bitbucket Cloud's release management capabilities by providing a unified dashboard. This open-source plugin integrates with Bitbucket Pipelines and Bamboo, allowing developers to monitor the entire commit-to-release pipeline by displaying information collected by Artifactory, Xray, and Bintray. The add-on, compatible with Pro, Enterprise, and Cloud editions, provides a 360-degree view of the build process, tracking each stage from development to production. Users can install the add-on by providing necessary credentials and view the dashboard directly from their Bitbucket Cloud repository. The dashboard offers insights into package promotion to production, build statuses, and the ability to download artifacts. The author emphasizes the significance of this project in supporting Atlassian's large-scale operations and encourages contributions to its open-source development.

In the context of software release, ensuring compliance and mitigating legal risks is crucial, particularly when dealing with open source software (OSS) components. The blog post discusses the challenges of enforcing OSS policies, highlighting the risks of unidentified components leading to potential license violations and costly legal issues. It outlines scenarios where license compliance is necessary, such as due diligence during company sales or fundraising, new product development, and ongoing product releases, where teams must manually track and review OSS licenses. JFrog Xray is presented as a solution to automate and simplify these compliance processes, offering functionalities like Policies to enforce license regulations and a component license report to eliminate manual tracking by automatically generating comprehensive OSS license reports. These tools help organizations efficiently assess and ensure the compliance of their OSS components, reducing the risk of errors and saving significant time and resources.

At the 2018 Atlassian European Summit in Barcelona, Atlassian introduced Code Insights, a new UX feature in Bitbucket Server designed to enhance developer productivity by integrating information from the DevOps toolchain into the pull request experience. Concurrently, JFrog announced an integration that injects critical data from its Artifactory and Xray tools directly into Bitbucket Server, allowing developers to access artifact details and security and license scanning results within pull requests. This integration aims to streamline the pull request review process by providing build details, dependency resolutions, and audit trails, thus reducing the time needed to address issues. Developers can configure this integration by setting up credentials and endpoints and incorporating a script into their CI pipeline. JFrog plans to continue updating this integration as Atlassian evolves the capability, with additional efforts including a DevOps Dashboard for Bitbucket Cloud and various integrations with Bitbucket Pipeline and Bamboo.