bsgeraci

Dang! Glad to see others doing this. I totally made this site yesterday like 11 hours ago :/ but did not get the traction.

I love your implementation.

Here was my first stab:

https://news.ycombinator.com/item?id=47595140

https://brandonrc.github.io/journey-through-claude-code/

I had claude code use the src code that was recently leaked to build an interactive website that explores claude code. :)

This was first pass with no modifications. I might have to go back and forth but pretty dang cool if you care about the nitty gritty.

Want to thank everyone for taking the time to make comments here. I am using what was said to improve the code base.

Currently active in some refactors. If anyone wants to test ArtifactKeeper I recommend waiting for my 1.0.0.a2 release. Hopefully by the end of the weekend.

Thanks again!!!

https://github.com/artifact-keeper

There are 7 or 8 repositories now in this org. Feel free to take, use, or help imrove the code. MIT Open Source.

yea so technically some of the formats are aliased :)

https://artifactkeeper.com/docs/package-formats/ Check this, you should see around 35 then 9 alias's that map to the other ones.

That is interesting, I have a good idea about setting up some red team agents and blueteam agents with claude code and seeing if we can improve security by testing things. In the pen test world these AI tools have basically beat all humans breaking into systems with no AI assistance.

If you have anymore details I would love to hear from your experience and what you think would be useful to look at. I will make a ticket based on this concern. I really want to make this as secure as we can and have people poke and do the code reviews. :)

Or analyse the code base. I am using security agents to harden the code base and testing end to end testing based on that.

Adding some security agents in the loop is a great idea!

I really think my next step is a full on CLI/TUI :)

Basically I am using end points so automation can be done with just curl requests. But as a linux nerd I do enjoy my share of CLI/TUI's.

Thanks for the kind words! If you need any help please reach out. My contact info is on github and I am happy to support making this happen.

I think we are in a time where we can make amazing things happen. I always go back to my Star Trek shows. We can now ask a computer to make a program for us. That is what I have been dreaming of. Now we are not at that level and lots of thought and experience goes into helping guide claude code but it is sometimes sci-fi like. The code is more clean, more maintainable for even myself. Everytihng is always commented, complexity is reduced.

I think if you follow a few rules whenever making changes and using all the latest tools like linters, security checkers, end to end frameworks, and any other helpful tool you can really make stuff happen.

I am totally thinking about adding this so you can connect to an API or use self hosted models that run in a container if you have the resources!!!! You are spot on.

I did not take your original comment as critiscism. Feel free to follow the repository and see how long I can keep it alive :)

There is no exsiting option :) unless you know where one is at. Artifactory OSS is a joke, and no other product is out there. Trust me I hate reinvinting the wheel... I rather take a nice wheel and use it.

If you find an existing full blown artifactory alternative that is opensource let me know.

Great question and I think about this a lot. I chose MIT deliberately and I'll explain why.

My graduate research focused on common computer security misconceptions — one of the biggest being that open source is inherently insecure. The algorithms and systems we trust most are the ones open to public scrutiny. AES was selected through an open competition where every candidate was published for the world to attack. TLS, SHA-256, RSA — their security comes from transparency, not obscurity. I believe the same applies to software infrastructure.

Could a bigger player take this and run a competing service? Sure, MIT allows that. But I'd rather have the code out there being used, audited, and improved than restrict it to protect a business model I don't even have yet. If someone like AWS wraps this in a managed service, that honestly means I built something worth wrapping — and the open version still exists for anyone who wants to self-host.

I've thought about the Canonical model — paid support around a free product — and I might go there someday. But I don't have years of production use behind this yet. We all start somewhere. Right now I'd rather focus on making the software good and building a community around it than optimizing a license for a monetization strategy that doesn't exist.

AGPL is a valid choice and I respect projects that use it. But for me, MIT is a statement about what I actually care about — the code being out there for everyone.

That is a great idea!

I made a discussion here :) I can keep you posted but if you have a github account just make a commet there follow so you stay up to date with that change.

https://github.com/orgs/artifact-keeper/discussions/36

https://github.com/orgs/artifact-keeper/discussions/34

I made this discussion here. Please jump on github and add some comments and maybe we can get this added :)

My graduate research focused on common computer security misconceptions — one of the biggest being that open source is inherently insecure. The reality is the opposite. The algorithms and systems we trust most are the ones that have been open to public scrutiny. AES was selected through an open competition where every candidate was published for the world to attack. TLS, SHA-256, RSA — none of these are secret.

Their security comes from transparency and years of public audit, not obscurity. The same principle applies to software. I see the legal argument for wanting a vendor to sue, and I've thought about something like Canonical's model for Ubuntu — offering paid support around a free product. But I don't have years of production use behind this yet. We all start somewhere. So for now, this stays open and free for everyone to use, and for me and others to maintain.

I have used oras, and that might be an interesting approach but not sure how it would work with search , version listing, dependenciton resolution, metadata quirere, permissions, and audit logs.

Are you sugesting some hybrid approach?

Feel free to use what I am building but I also think more people just need to try and build something. We are almost in a star trek style world where you are talking to a computer to make a holo deck promgram :) sorry for the trekkie talk.

My recommendation with testing out hands free agentic, know it is not fully hands free. I find my self babysitting alot of terminals going at once, like having a bunch of interns or junior devopers.

It is important to plan plan plan.

I want to eventually switch and play with self hosted models but for most agentic stuff Claude is killing it in terms of results.

I have had claude go back and forth with codesimplifier agent (they developed) and a security agent.

I think adding this to your workflow helps but you have to make sure to have end to end testing on the mind. Because some changes can break things real fast.

My process is pretty plain outside of paying anthropic too much money a month. Only thing extra I am using is the beads currently. I was using speckit and ralph-loop but as of last week it does not seem to be needed. THink anthropic is baking some of thes tools into claude code.

Claude is... unfortunetly... that much better. They really know how to use the tools that integrate into CLI that just makes the flow so much better.

The only extra stuff I am doing now is beads. https://github.com/steveyegge/beads

I was using speckit and ralph-loop but think anthropic baked in that ralph-loop. Basically a dumb while true until you break with the condition.

Ok updated docs https://artifactkeeper.com/docs/security/scanning/

SHould have info on the CVE, please leave some issues on the repository if you want to see more infromatoin on the actual dashbaord/ui :)

Thanks for the feedback!

I will add some todo's for me. I know how important this is.

I think it is right to be skeptectial and I hope this project can prove people wrong.

I am using the openscap and trivia. Can you add a discussion to my github about some of this. I would love some of your feedback on what you need on your level. I need to check the update mechanism so we are keeping the database up to date. I also want a way to keep it up to date when it is airgapped, not everyones use case but one I have delt with at my jobs.

I still need to put some e2e testing on those policies. https://demo.artifactkeeper.com/security/policies here is a demo and you can add a policy. Again that one I need to make a series of end to end testing but that was designed in mind :) I really want a staging area and promotion of packages after scans.

On my list of things to do.

I would say do not trust it, but use it and try it. Hopefully over time I can build trust by people using it.