July 2019 Summaries

JFrog Artifactory is a versatile repository manager that integrates seamlessly with various CI/CD tools like Jenkins, CircleCI, and Bitbucket, and can handle artifact management both on-premises and in the cloud. It is designed to adapt to changes in tools and environments, making it a flexible solution for managing software artifacts. Complementing Artifactory is JFrog Xray, a vulnerability scanning tool that emphasizes the integration of security within the software development lifecycle, supporting multiple package types such as Maven, Gradle, and Docker. Xray offers native integration with Artifactory, providing immediate access to security and license scanning capabilities without the need for additional setup. This integration enhances DevSecOps by offering radical transparency and rich impact analysis, ensuring that security and compliance are integral parts of artifact management. Xray continuously monitors and analyzes software components, ensuring that vulnerabilities are identified and managed throughout the entire software development process, even after deployment, thus supporting a comprehensive and proactive approach to security in the DevOps pipeline.

Developers working with GoLang can now efficiently implement continuous integration and continuous delivery (CI/CD) workflows using Artifactory due to recent advancements in Go, including native support in Artifactory. Unlike older programming languages that had established dependency management systems, Go initially lacked a unified system until the introduction of Go modules in Go 1.11, which streamlined versioned dependency management. Best practices recommended by JFrog include using Go modules for dependency management, setting up a GOPROXY for immutability and availability of modules, and structuring Artifactory repositories for efficient binary management. These practices enable developers to build and promote Go-based microservices reliably through different pipeline stages, avoiding monolithic pipelines by allowing separate teams to manage different layers of the application. Artifactory serves as a central repository for both public and private Go modules, and the JFrog CLI facilitates interaction with Artifactory, ensuring builds are traceable. Implementing these strategies enhances the CI/CD process, allowing developers to release Go applications efficiently and with high quality.

Creating a custom Artifactory Docker image using the Red Hat Universal Base Image (UBI) allows organizations to maintain the security and support associated with Red Hat Enterprise Linux while transitioning to containerized platforms. This process is particularly relevant for organizations that require specific OS features or custom images, as it provides a way to combine Artifactory with the reliability of Red Hat's ecosystem. By using a Dockerfile and leveraging multi-stage builds, users can specify versions and configurations, enabling the creation of a tailored container image. The guide outlines the necessary components, including specific Artifactory and UBI versions, and demonstrates how to construct the Dockerfile to prepare the image, set permissions, and establish the entry point. Additionally, it highlights the advantages of using Artifactory as a Docker registry to manage and deploy the custom images, ensuring that all components remain updated and secure. This approach facilitates a seamless transition to scalable, containerized software while preserving the benefits of the Red Hat platform.