TechPrufer
Get started
Microsoft
Microsoft logoMicrosoft · Feature trail

Azure Artifacts Feed Scoping and Management

10 posts · Aug 2015 – Sep 2020

What this trail covers

Azure Artifacts supports hosting and consuming packages from various repositories, including Google Maven Repository, Gradle Plugins, Jitpack, and PowerShell Gallery, as upstream sources. It also introduces a new security behavior to limit access to externally sourced packages when internally sourced packages are present, preventing the inadvertent consumption of malicious packages. Organizations can opt out of this behavior via an organization-wide security policy. Azure Artifacts also supports Maven/Ivy package management.

All Microsoft trails
  1. Optimizing package storage (and costs!)This post provides practical tips and strategies for optimizing Azure Artifacts package storage to reduce monthly costs. It emphasizes leveraging feed-level retention policies for automatic deletion, manual deletion of unused feeds and package versions, and programmatic deletion using Feed Management APIs and protocol-specific package APIs. It also advises on setting cost limits through Azure Portal's cost management features and understanding specific charges within Azure DevOps billing. The post highlights the upcoming storage breakdown feature and billing changes.
  2. New with Azure Artifacts: public and project-scoped feedsIntroduced Public Feeds allowing packages to be shared publicly without authentication. Introduced Project-Scoped Feeds, allowing feeds to be scoped to a specific project within an organization, addressing feedback on organizational counter-intuitiveness. Added a Feed Recycle Bin to store deleted feeds for up to 30 days, enabling restoration and preventing accidental data loss. Implemented backend performance improvements leading to significantly shorter feed load times.
  3. Share packages publicly from Azure Artifacts - Public PreviewIntroduced public feeds in Azure Artifacts, allowing anonymous access to NuGet, npm, Maven, and Python packages for users outside of an Azure DevOps organization. The first 2 GB of public packages are free, with additional storage charged per GB per month.
  4. Pay-per-GiB pricing and more Azure Artifacts updatesThis post announces the removal of the separate license for Azure Artifacts, transitioning to a pay-per-GiB storage model with 2 GiB free. Python and Universal Packages are now generally available. Public feeds are planned for preview. This post also reiterates the supported package types (Maven, npm, NuGet, Python, Universal Packages) and its function as a symbol server, along with its integration with Azure Pipelines.
  5. Blocking malicious versions of event-stream and flatmap-stream packagesAzure DevOps has implemented blocking for specific malicious versions of the `flatmap-stream` (0.1.0, 0.1.1, 0.1.2) and `event-stream` (3.3.6) npm packages. This action prevents these versions from being downloaded or published to Azure DevOps feeds, aligning with npm's security advisory. Customers with these packages in their feeds will be contacted.
  7. Blocking malicious event-stream and flatmap-stream packagesBlocked specific malicious versions (0.1.0, 0.1.1, 0.1.2) of the `flatmap-stream` package and version 3.3.6 of the `event-stream` package in Azure DevOps feeds to prevent the exfiltration of bitcoin wallets. This action mirrors the steps taken by the npm package manager and Visual Studio Code.
  8. Package Management adds nuget.org upstream sourceThis post introduces the public preview of the NuGet.org upstream source for Azure Artifacts. This feature allows users to consolidate their dependencies by using their Azure Artifacts feed as a single product feed that contains both internally produced and externally consumed packages. When connected to a package client, users can publish or install packages from an upstream source without changing sources or configuring multiple sources on the client. A key benefit is guaranteed saving of packages used from an upstream source, ensuring availability even if the original source is down. For TFS users, upstreams can provide faster access to packages by serving subsequent requests from the local TFS server cache. The post details how to create a new feed with upstream sources enabled by default and how to save packages from nuget.org by running commands in the Visual Studio Package Manager Console.
  9. Improved package support in Team BuildThis post introduces major improvements to the NuGet, npm, and Maven build tasks in Team Build. For NuGet, it consolidates the Installer/Restore, Packager, Publisher, and Command tasks into a single 'NuGet' task and adds a 'NuGet Tool Installer' task to control the NuGet version. It also introduces feed pickers for restore/push commands and credentials for external feeds. For npm, it focuses on better support for authenticated feeds and adds a 'command' selector. For Maven, it adds support for authenticated feeds within the same VSTS account or TFS collection. The .NET Core task also sees improvements for NuGet operations and a new '.NET Core Tool Installer' task.
  10. Package Management is generally available: NuGet, npm, and moreThis post announces the general availability of Package Management for Team Services and TFS 2017, including best-in-class support for NuGet 3.x clients and the addition of npm package support. It details pricing, regional availability, and future investment areas such as package lifecycle management, dependency management, a refreshed user experience, and support for Maven/Ivy packages.
  11. Announcing Package Management support for VSO/TFSIntroduced a new package management service for Visual Studio Online and Team Foundation Server, enabling management, storage, security, and sharing of binary components within an organization. Supports private hosted packages (initially NuGet, with plans for others like npm, Docker, and build drops), consistent component access for builds, enterprise authentication for permissions, integration with build and release management tools, and discovery/search of packages across an enterprise. Feeds are the core concept, acting as containers for packages with managed permissions. Enterprise-grade authentication uses the VSO security model. Integration with VSO build and release management is seamless, with support for external build tools via extensions. NuGet is the first supported package type, with plans for NPM, Bower, Ivy, Maven, .zip, and CocoaPods.