Setting Up Your Own Private, Secured Package Repository - Why and How
summary
Argues that a private curated repository gives concrete gains: security checks, guaranteed availability, lower bandwidth cost and control over allowed versions. Demonstrations use Nexus (primary), Artifactory and ProGet installed on one VM, Chocolatey/NuGet clients, Visual Studio Code with zip explorer, VirusTotal and an MSI inspector to inspect and push packages. Shows proxy feed caches metadata and a working curation pipeline that uploads curated packages and resolves 150+ dependency tree across feeds, with cross‑feed dependency resolution succeeding in the demo.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:32Questions
- 7:22Benefits and Challenges
- 10:09Curation
- 15:35Visual Studio Code
- 17:28Curate
- 21:20PowerShell Module Curation
- 27:14Customization Packages
- 36:47Security
- 37:47Local User Nexus
- 38:17Role Permissions
- 41:22Package Management
- 46:02Additional Resources
related talks
15mSetup a Private, Secure, Cloud-native, Ultra-fast Repository in 60 sec w/Cloudsmith
42mImproving Package Repository Security – From White Papers to Practice
40mCurating and Securing Open Source for the GovCloud
57m.NET supply chain: Protecting against hidden threats
34mRising Threat: Securing Your Open-Source Pipeline
27mDevSecOps - Why Debian repositories are Mission-Critical!
32mEasier, Faster, and Safer Open Source Consumption Governance
42mThe Data Behind DevSecOps: The Power of Hindsight to Protect your Supply Chain