Course · Intermediate
Artifact Repositories
Host, secure, sign and serve the packages and images your deployments depend on, with Pulp as the reference and Nexus as an option
- 2 levels
- 9 modules
- 28 lessons
- 13 labs
- 25 quizzes
- 21h
Start Lesson: Artifact management: the complete DevSecOps guide
Recommended before you start: Linux
About this path · first level: 4 lessons, about 1 week
Welcome to your Artifact repositories path. This page lists the whole course, in the order in which the notions build on one another. An artifact repository is the service that keeps the packages, images and binaries your deployments consume: knowing how to operate it means knowing what your production really installs.
The first modules set out the vocabulary and the reason for being: the lifecycle of an artifact, the difference between a tag and a digest, and the promotion of the same binary from one environment to the next without rebuilding it. One whole module is devoted to software supply chain security, because a repository is only worth what it can prove about what it serves: SBOM, SLSA levels and verified provenance.
Then come the hands-on steps, on Pulp as the reference implementation: put it into service, make it act as a cache in front of a public repository, publish your own packages, use it as an image registry, grant measured rights on it, sign what it hosts, make it serve without Internet, and restore a backup until a client is served by what was restored.
One module repeats these same steps on Nexus, and only for what it does differently: there is no need to relearn a skill you already have. The next module compares Artifactory and Harbor, so that you know which criterion to choose on, rather than choosing out of habit.
The last module decides what crosses the door: securing npm, PyPI and Go dependencies, filtering what comes in with an artifact firewall, and serving a continuous integration pipeline without depending on the public repositories.
Yes, it is a long path. Nobody follows it in one go: it is split into levels. The first one, "Put an artifact repository into service", is 4 lessons of about 45 minutes: at one per working day, roughly 1 week, and it ends with its own result. Each module gives you a skill you can use the next day, and your progress waits for you in this browser and on the devices linked to your optional account.
Reach a goal
This topic path gathers all our content on the domain. Your personal path may only use part of it.
- Skills 8 (+10 in part) 8 by quiz · 3 in a lab · 5 with a proof
Progress 0 / 28 (0%)
- Knowledge Not measured Your first quiz will show up at the end of a lesson.
- Practice Not measured Labs measure what you can do. You do not need DSOXLab to start a course.
- Proof Not measured Challenges and hands-on exams check that you can act without step-by-step instructions.
Tick lessons here, or with “Mark as read” at the end of each lesson. Progress stays in this browser; nothing is sent to the server unless you link this browser to an optional account.
A1
You install an artifact repository, cache the public repositories behind it, publish your own packages to it and serve your images from it, each time proving from a client that your repository is the one that answered.
Level validation: Challenge · Level 1 exam: the repository nobody documented
A2
You grant rights without opening the whole repository, sign what you serve, keep the instance working without Internet access, and restore its content somewhere other than the machine that hosted it.
-
06
-
Grant targeted access to an artefact repository and prove it opens one door only
-
Sign a repository's artefacts and make verification fail on an unsigned one
-
Serve an artefact repository with no Internet access and bring content in by export and import
-
Back up an artefact repository and prove the restore serves a client
-
Context and landmarks
-
Level validation: no validation test is defined for this level yet.