we're evaluating using Artifactory as a proxy for pypi.org so we can whitelist packages for our developers, and prevent things like typosquatting. I was pleasantly surprised when inital setup of the repository cache (as described in https://jfrog.com/help/r/jfrog-artifactory-documentation/remote-repositories) was done in about two minutes. However, Include Patterns don't seem to work the way we thought - at least for Python packages. Blank Include and Exclude Patterns work as expected, all packages can be installed through the cache. Adding **/numpy* to the Include Patterns works as expected. Only numpy can be installed; other packages like pandas cannot be installed. However, whitelisting **/numpy* also allows similarly named packages like numpyx, numpyp, etc. Which isn't exactly the idea of whitelisting. We haven't been able to find expressions that will allow precise whitelisting. Adding any or all of the following patterns will not allow installation of numpy. **/numpy*/** **/numpy/* **/numpy/** **/numpy/ There's other weird symptoms: **/Cython* does not allow installation of Cython, but **/cython* does. So it looks only lowercase patterns work (okay, this is probably because pip install shows a 'nice' name, but the url is all lowercase) **/pyproject-metadata* does not allow installation of pyproject-metadata, but **/pyproject* does. So it looks like dashes in package names break patterns too. We were hoping to do version pinning, but it doesn't look like this will be possible. Also there's no export/import functionality for lists of Include/Exclude Patterns, and maintaining them through the web interface would probably get hard to manage soon. I was under the impression that Artifactory is an enterprise-grade solution for scenarios just like this, but this looks to broken to be useful. Am I missing something? Are there other patterns? Are there plugins that work better? Do we need to switch to an entirely different solution? Thanks. Continue reading...
