March 2021 Summaries

The latest JFrog Platform release introduces several enhancements to scale and secure software supply chains for digital businesses. It offers improved repository protection for binaries and dependencies, project-level autonomy in DevOps management, and support for the Rust development community through new Cargo package type support. Key features include priority resolution for Nuget repositories to prevent dependency confusion attacks, enhanced identity management with SCIM, integration with HashiCorp Vault for secure key management, and private AWS Cloud endpoints for increased security. The platform also introduces JFrog Projects, allowing project-level administrators to manage resources, roles, and permissions, thereby facilitating efficient scaling for larger enterprises. Additionally, the platform supports over 30 package types, with new capabilities like proxying remote Cargo resources and live logs for faster troubleshooting. These updates aim to enhance security and efficiency in managing software development and release processes across diverse infrastructures.

The integration of the JFrog DevOps Platform with Microsoft Azure allows users to enhance security and streamline user administration by leveraging Azure Active Directory for credential management, specifically through Single Sign-On (SSO) and Security Assertion Markup Language (SAML). This setup facilitates seamless user access across various services using a single set of credentials, thereby simplifying administrative tasks and enhancing security. The process involves integrating JFrog Artifactory with Azure Active Directory, configuring SAML SSO, and managing permissions for DevOps resources through a unified interface. This integration not only provides fine-grained control over access to repositories and pipelines but also utilizes Azure's existing infrastructure and cloud credits, making it a convenient option for organizations hosting their JFrog Cloud Enterprise accounts on Azure.

In a reflective piece, the author shares their personal journey of transitioning from familiar development tools to a new set that included Git, GitHub, a MacBook Pro, and IntelliJ upon starting a new job in 2014. Despite initial discomfort and challenges adapting from a Windows environment and tools like SVN, the author grew to appreciate the new tools for their productivity and efficiency. This transition mirrors the broader move by the OpenJDK community from Mercurial to Git and GitHub for hosting repositories, as outlined in JEP 357 and JEP 369. The migration aims to tap into GitHub's extensive developer community, streamline workflows, and enhance collaboration through GitHub's robust API and integration capabilities. The piece highlights the strategic decision to maintain familiar workflows for existing contributors while opening doors for new contributors familiar with Git and GitHub, reflecting a broader industry trend toward adopting widely-used, flexible, and integrated development tools.

Ensuring the safety of open-source components used by teams and sites can be effectively managed with a software composition analysis (SCA) tool like JFrog Xray, which offers vulnerability and license compliance scanning integrated into the software development lifecycle. Xray provides enterprise-wide visibility into software components, supporting fast distribution without vulnerabilities or license issues, whether on-premises, in the cloud, or in hybrid environments. To implement Xray, users must log in to their environment, set up JFrog Artifactory with their chosen repository, define security and license compliance policies, select repositories to monitor, and assign these policies to watches. Users can manually trigger scans to ensure immediate application to relevant artifacts, with results displayed in a dependency tree highlighting detected security vulnerabilities.

JFrog CLI provides an efficient interface for managing builds with JFrog Artifactory and Xray, enhancing automation and maintainability. As of version 1.14.0, it supports Docker builds alongside npm, Maven, Gradle, and Go. The process involves configuring Artifactory, building Docker images, publishing build information, scanning with Xray for vulnerabilities, and promoting tested builds to production. This integration ensures that the same tested Docker image reaches production, thereby increasing reliability. The workflow requires setting up the environment with necessary tools like Docker client, Artifactory, and Xray, and involves specific JFrog CLI commands to manage the entire process seamlessly.

JFrog Pipelines is a powerful DevOps CI/CD automation solution designed to streamline the process of building, testing, and deploying software. It integrates seamlessly with JFrog Artifactory, addressing security and compliance needs while allowing for flexible and repeatable builds that align with local environments. By leveraging native steps and extensions, users can efficiently create custom pipelines that cater to specific project requirements. The use of extensions allows for task abstraction and resource sharing, enabling developers to maintain consistency across different builds. This facilitates a smoother transition from local development to CI environments, enhancing deployment reliability. Additionally, a publicly available Extensions Registry on GitHub provides a resource for the DevOps community, offering examples for various programming environments and promoting shared learning and collaboration.

Java 16 introduces the jpackage tool, which simplifies the deployment of self-contained Java applications by creating native installers that include the application, dependencies, and a tailored Java Runtime Environment (JRE). This innovation follows the advent of Docker, which revolutionized application deployment by packaging the entire execution environment. jpackage, however, focuses on Java applications, providing a streamlined process that allows developers to create executable packages for various platforms without requiring the complete JRE. By utilizing jlink to craft a minimal JRE, developers can efficiently build and distribute Java applications. The tool does not aim to replace Docker but complements it by enabling standalone Java applications to run anywhere, ensuring platform independence and ease of distribution. To facilitate distribution, developers can use cloud services like JFrog Platform for hosting and serving these packages, enhancing accessibility and download speeds globally. This development addresses the perennial question faced by Java developers on how to efficiently package and deploy applications, making Java 16 a significant step forward for the Java community.

In response to the challenges faced in 2020, JFrog has introduced several enhancements to its platform to improve the DevOps experience, focusing on Docker rate limits, security, and package management. The JFrog Platform now optimizes Docker Registry functionality, ensuring that users do not encounter image-pull limits from Docker Hub, while also offering features like enhanced logging and the use of the Docker Content Digest. JFrog Xray provides detailed reports on vulnerabilities and license compliance, allowing users to manage security risks effectively by triaging OSS risks and setting ignore rules for certain violations. New permissions roles enhance report management, and support for new package technologies such as Alpine Linux, OCI images, RubyGems Bundler, and Helm V3 has been added, catering to both cloud-native applications and self-hosted DevOps infrastructures. These updates aim to help JFrog users minimize risks and costs while securing software releases more efficiently.

JFrog, known for assisting software producers in achieving regulatory compliance, has expanded its DevOps Platform solutions, JFrog Artifactory and JFrog Xray, to include native deployment templates for AWS GovCloud (US) and Azure Government clouds. This expansion supports highly regulated industries such as banking, finance, manufacturing, and retail, enabling them to meet stringent requirements like ITAR, FedRAMP, DFARS, and DoD (SRG) Impact Levels. These solutions offer encryption, key management, auditing, and monitoring features to ensure security compliance, facilitating a smooth and secure installation process in government cloud environments. Designed for enterprises and U.S. government entities, JFrog’s offerings enhance DevSecOps efforts by providing a seamless flow of software updates. Available through a self-hosted license requiring a JFrog Enterprise subscription, these solutions can be deployed via AWS and Azure Marketplaces, supporting both hybrid and multi-cloud infrastructures. The platform is also available as a SaaS subscription across multiple cloud regions, including private instances, ensuring flexibility and scalability for large organizations engaged in secure, regulated work environments.