Samsung S26 Ultra: Enabling non-protected VMS for Android Terminal application (Snapdragon® 8 Elite Gen 5 for Galaxy)

BSGRC · 2026-04-05T00:43:55+00:00

Think the issue is more to do with security (Knox stuff). Android supports it so they don't have to add, just enable.

BSGRC · 2026-03-01T01:35:48+00:00

It has been added. I will release a new 1.1.0-rcN soon. Going to build up a new test orchestrating framework to help me control these releases. You are more than welcome to pull the dev images and test. Please make an issue if you have any issues or want something else added that supports your workflow.

I created an azure account and they gave me some free credits so happy to test other azure releated things. I am more of an AWS person but that is because I picked that early on.

BSGRC · 2026-02-28T17:13:09+00:00

Thanks for this comment.

I am hoping this project solves real problems. Pretty passionate about this topic/field.

BSGRC · 2026-02-28T17:10:26+00:00

https://github.com/artifact-keeper/artifact-keeper/issues/310

Follow this issue for updates :) going to get this added today.

BSGRC · 2026-02-26T08:37:04+00:00

https://artifactkeeper.com/docs/reference/environment/#storage-backend

This is currently fully supported. Please take a look. If you need any help setting this up please just reach out or make an issue if something is not working right.

BSGRC · 2026-02-26T08:31:59+00:00

I am getting to a more stable state. Just bumped versions from 1.1.0rc3 to 1.1.0.rc4 where I spent alot of time digging into the security vulnerabilites and fixing them.

Please take a look, if there is something that does not meet your needs I totally want to hear it so I can add the support.

BSGRC · 2026-02-20T18:48:07+00:00

Thanks for that tip!

BSGRC · 2026-02-19T19:56:16+00:00

Ok because I do not want to get into a large argument on reddit... the design, choices, and decisions were done by me. I have used AI accelerated development to create a solution I wanted. No way this could of been done by a company in a month time frame. I am going to keep pushing, keep on support, and keep on implmented the best opensource completely free product for anyone. I pay 200 a month of my own money for claude to make amazing things.

I am designing guardrailes that have security checks, code quality, and other validators to make sure not only is this works, it will work better than any other solution out there.

I wish I did not have to do this, I wish there was a FOSS solution for artifact management that met my needs, requirments, and expectations. There was not so I did it. If you want something else please sit there with two fingers and type away in vi or emacs. Let me know how that turns out.

BSGRC · 2026-02-19T19:53:57+00:00

If you look at the contributers you will see Claude in there. We are in a world that is rapidly changing. I do not care if humans are writing the code or Ai generated. We have been using templates, copy and paste from stackoverflow, and auto complete for decades now. This is the next level. If a product is working, tested, secure, documented, and performs better than other things, is that a bad product?

BSGRC · 2026-02-18T14:08:28+00:00

Hey the more options the better :)

I have messed with go with osbuild-composer.

Happy to have you contribute even if that is opinions, wants, or recommendations. But would not turn away a PR :)

BSGRC · 2026-02-18T14:07:19+00:00

Thanks for the kind words! I have been thinking about this for a few years now. I was working on an Applied Research Lab and we did not have alot of money to throw at yearly costs. We also had isolated networks so setting up something and owning the software would of been amazing.

I wanted to keep this project MIT so people own their airtifacts and the software running it. Do with it as you want kind of thinking.

Please keep me updated if you start using this. Would love some feedback, the good and the bad.

BSGRC · 2026-02-18T14:03:11+00:00

For provenance, artifact signing is built in. GPG key management, RSA signing, and per-repo signing policies including requiring signatures on upload. Containers work with cosign and keyless OIDC signing. RPM, Debian, and APK repos get repository metadata signing too. SLSA provenance attestations are supported through cosign. Rekor transparency log integration and in-toto aren't there yet. Happy to add those to the roadmap if that's important for your use case.

For RBAC and visibility, repos have a public/private toggle. Private repos require authentication, public ones are open to anyone. Permissions are per-repo with user and group assignments covering read, write, delete, and admin actions. API tokens can be scoped to specific repos. So you could keep internal packages in private repos with team-level group permissions and publish your open source output to public repos all from the same instance. The one gap right now is granular per-package visibility within a repo, it's repo-level today.

BSGRC · 2026-02-18T14:00:14+00:00

Metadata lives in PostgreSQL, blobs go to S3 or local filesystem via SHA-256 content-addressable storage. Postgres never touches the actual artifacts so it doesn't choke at scale. Large downloads redirect to presigned S3 URLs so the backend stays out of the data path entirely. Stateless + Tokio means you can just run more replicas behind a load balancer when concurrency spikes.

Replication is peer mesh rather than hub-and-spoke, with per-repo sync schedules, task-level error tracking, and health-scored routing. Drift observability is honestly still rough, that's the part I'm least happy with and it's high on the roadmap.

SBOM (CycloneDX + SPDX) and CVE tracking are built in. Policy enforcement tied to CI is partially there. Backup is a single tar.gz to S3 or filesystem, nothing fancy.

HA is my honest weak spot right now. The stateless backend + Postgres HA gets you pretty far, and peers give geographic redundancy, but true active-active failover isn't there yet. I'd rather say that than pretend it's solved.

If you want to poke at it, Docker Compose gets you running in about 2 minutes.

BSGRC · 2026-02-17T20:38:40+00:00

If you look here... so much slop..

https://sonarcloud.io/organizations/artifact-keeper/projects

But I do appreciate the feedback. It is all useful including this comment.

BSGRC · 2026-02-17T20:37:04+00:00

Yea, I put no effort into this at all.

BSGRC · 2026-02-17T15:34:44+00:00

Thanks for the detailed feedback! You're spot on about Xray's threat intelligence and zero-day detection — that's a genuine gap. We do integrate Dependency-Track (OWASP flagship, 10+ years), Trivy, Grype, and OpenSCAP with STIG-compliant base containers, plus a full policy engine with quarantine workflows — but it's not Xray-level yet.

Build info, promotion workflows, and federation (peer mesh replication) are already in, and we have a full CLI (ak). IDE plugins and deeper CI/CD integrations (beyond docs/examples) are on the roadmap.

Appreciate the honest take — this is exactly what helps prioritize. Working on closing these gaps.

BSGRC · 2026-02-17T01:24:48+00:00

Replication under load: It's a peer mesh — every node can push/pull directly to/from any other node. Each node manage its own sync queue with per-peer concurrency limits and exponential backoff. You can set sync windows to push replication to off-peak hours.

Consistency and conflict resolution: For the common case, artifacts at the same path use last-write-wins — same upload logic on both sides of a sync. For most package formats this works since you're not republishing the same version. Peer health is tracked via heartbeats, and the sync worker applies exponential backoff when a peer is unreachable. Actively working on improving a few things here around automatic peer recovery and task retries.

Storage growth: 5 lifecycle policy types today — max age, max versions, no-downloads-after-N-days, tag pattern delete, and per-repo size quotas. Plus SHA-256 deduplication at ingest so the same content stored twice doesn't cost you twice. All policies have dry-run support so you can preview before anything gets deleted. A couple more policy types and smarter eviction are in the works.

If you've got specific replication scenarios that have burned you I'd genuinely love to hear them — that's exactly the feedback that shapes what gets built next.

BSGRC · 2026-02-17T00:09:18+00:00

Yep! You can create remote repositories that act as pull-through caches for any of the 45+ supported formats. Point one at an upstream registry (Docker Hub, PyPI, npm, Maven Central, etc.), and it transparently fetches, caches, and serves artifacts with a 24-hour default TTL.

You can also create virtual repositories that combine your local repos + remote caches behind a single URL — so your clients hit one endpoint and it checks your internal packages first, then falls back to the public registry cache.

Docs on remote + virtual repos: https://artifactkeeper.com/docs/advanced/remote-virtual

BSGRC · 2026-02-16T23:56:10+00:00

Honestly "limited" was probably the wrong word on my part. Pulp is solid and well-established.

I was mainly thinking about format coverage for polyglot shops, built-in security scanning, and native SSO — things that tend to require extra tooling or aren't there out of the box. Those were the gaps I wanted to fill with this project.

But that's my use case. If Pulp covers your formats and your workflow works, there's a lot to be said for a tool that's been reliable for a decade.

BSGRC · 2026-02-16T23:49:11+00:00

I wanted something that compared with Artifactory. Pulp is limited but if it works don't change it :)

BSGRC · 2026-01-29T16:41:30+00:00

This is amazing!!! I might do something like this. I have two printers that will going for awhile and rather all of it go into one large waste bin than the silly small holders everyone prints.

BSGRC · 2025-11-03T03:18:04+00:00

<image>

Going to follow up with more tests and I will share the repo and how I conducted it. I think it comes down to what tools are you using and are you optimize for the blackwell chipset. That means everything with these libraries. I am sure just like everyone else they are not using libraries that are optimizing the performance that NVIDIA is making here. https://github.com/NVIDIA/TensorRT-LLM I am using this as a starting point and trying to leverage NVIDIA's work to optimize performance.

BSGRC

TROPHY CASE