bsgeraci

I love your implementation.

Here was my first stab:

https://news.ycombinator.com/item?id=47595140

https://brandonrc.github.io/journey-through-claude-code/

This was first pass with no modifications. I might have to go back and forth but pretty dang cool if you care about the nitty gritty.

Currently active in some refactors. If anyone wants to test ArtifactKeeper I recommend waiting for my 1.0.0.a2 release. Hopefully by the end of the weekend.

Thanks again!!!

There are 7 or 8 repositories now in this org. Feel free to take, use, or help imrove the code. MIT Open Source.

https://artifactkeeper.com/docs/package-formats/ Check this, you should see around 35 then 9 alias's that map to the other ones.

If you have anymore details I would love to hear from your experience and what you think would be useful to look at. I will make a ticket based on this concern. I really want to make this as secure as we can and have people poke and do the code reviews. :)

Or analyse the code base. I am using security agents to harden the code base and testing end to end testing based on that.

Adding some security agents in the loop is a great idea!

Basically I am using end points so automation can be done with just curl requests. But as a linux nerd I do enjoy my share of CLI/TUI's.

I think if you follow a few rules whenever making changes and using all the latest tools like linters, security checkers, end to end frameworks, and any other helpful tool you can really make stuff happen.

If you find an existing full blown artifactory alternative that is opensource let me know.

My graduate research focused on common computer security misconceptions — one of the biggest being that open source is inherently insecure. The algorithms and systems we trust most are the ones open to public scrutiny. AES was selected through an open competition where every candidate was published for the world to attack. TLS, SHA-256, RSA — their security comes from transparency, not obscurity. I believe the same applies to software infrastructure.

Could a bigger player take this and run a competing service? Sure, MIT allows that. But I'd rather have the code out there being used, audited, and improved than restrict it to protect a business model I don't even have yet. If someone like AWS wraps this in a managed service, that honestly means I built something worth wrapping — and the open version still exists for anyone who wants to self-host.

I've thought about the Canonical model — paid support around a free product — and I might go there someday. But I don't have years of production use behind this yet. We all start somewhere. Right now I'd rather focus on making the software good and building a community around it than optimizing a license for a monetization strategy that doesn't exist.

AGPL is a valid choice and I respect projects that use it. But for me, MIT is a statement about what I actually care about — the code being out there for everyone.

I made a discussion here :) I can keep you posted but if you have a github account just make a commet there follow so you stay up to date with that change.

https://github.com/orgs/artifact-keeper/discussions/36

I made this discussion here. Please jump on github and add some comments and maybe we can get this added :)

Their security comes from transparency and years of public audit, not obscurity. The same principle applies to software. I see the legal argument for wanting a vendor to sue, and I've thought about something like Canonical's model for Ubuntu — offering paid support around a free product. But I don't have years of production use behind this yet. We all start somewhere. So for now, this stays open and free for everyone to use, and for me and others to maintain.

Are you sugesting some hybrid approach?

My recommendation with testing out hands free agentic, know it is not fully hands free. I find my self babysitting alot of terminals going at once, like having a bunch of interns or junior devopers.

It is important to plan plan plan.

I want to eventually switch and play with self hosted models but for most agentic stuff Claude is killing it in terms of results.

I think adding this to your workflow helps but you have to make sure to have end to end testing on the mind. Because some changes can break things real fast.

My process is pretty plain outside of paying anthropic too much money a month. Only thing extra I am using is the beads currently. I was using speckit and ralph-loop but as of last week it does not seem to be needed. THink anthropic is baking some of thes tools into claude code.

The only extra stuff I am doing now is beads. https://github.com/steveyegge/beads

I was using speckit and ralph-loop but think anthropic baked in that ralph-loop. Basically a dumb while true until you break with the condition.

SHould have info on the CVE, please leave some issues on the repository if you want to see more infromatoin on the actual dashbaord/ui :)

Thanks for the feedback!

I still need to put some e2e testing on those policies. https://demo.artifactkeeper.com/security/policies here is a demo and you can add a policy. Again that one I need to make a series of end to end testing but that was designed in mind :) I really want a staging area and promotion of packages after scans.

On my list of things to do.