TechPrufer
Get started
Microsoft
Microsoft logoMicrosoft · Feature trail

Azure Artifacts Rust Crate Support

13 posts · Aug 2015 – Aug 2023

What this trail covers

Azure Artifacts supports hosting and consuming packages from various repositories, including Google Maven Repository, Gradle Plugins, Jitpack, and PowerShell Gallery, as upstream sources. It also introduces a new security behavior to limit access to externally sourced packages when internally sourced packages are present, preventing the inadvertent consumption of malicious packages. Organizations can opt out of this behavior via an organization-wide security policy. Azure Artifacts also supports ingesting Universal Packages from different ADO organizations into your feed, with a size limitation of up to 4TB. Upstreams for Universal Packages are configured the same as upstreams for any other package type.

All Microsoft trails
  1. Introducing Azure Artifacts support for Rust CratesThis post announces the public preview of Azure Artifacts support for Rust Crates. It enables Rust projects to streamline crate hosting, sharing, and consumption for both private and public crates within the Azure DevOps ecosystem. Users can connect their Rust projects to their Azure Artifacts feed by navigating to Artifacts within their Azure DevOps project.
  2. Azure Artifacts introduces new Upstreaming capabilitiesThis post announces the release of upstreaming capabilities for Universal Packages across different Azure DevOps organizations. Previously, Universal Packages could only be shared within the same organization. This new feature allows ingestion of Universal Packages up to 4TB from other ADO organizations into an Azure Artifacts feed. Configuration is the same as for other package types, requiring an ADO Services Feed locator. The post also references updated documentation for setting up cross-org upstream sources and publishing/downloading universal packages, and requires artifacttool version 0.2.204 or later.
  3. Azure Artifacts now provides native support to use packages from more repositoriesThis post announces the native support for Google Maven Repository, Gradle Plugins, Jitpack, and PowerShell Gallery as upstream sources in Azure Artifacts. It provides step-by-step instructions for enabling these new upstream sources when creating a new feed or editing an existing one.
  4. Changes to Azure Artifacts Upstream BehaviorIntroduced a new security behavior for Azure Artifacts feeds that limits access to externally sourced packages when internally sourced packages are already present. This prevents the consumption of malicious packages from public registries. The behavior is applied when an internally sourced version exists or when consuming a package for the first time if an upstream version is internally sourced. Versions from public registries will be blocked unless explicitly allowed via configuration. An organization-wide security policy 'Additional protections when using public package registries' can be toggled off to opt out.
  5. Optimizing package storage (and costs!)This post provides guidance on optimizing package storage and reducing costs within Azure Artifacts. It details leveraging automatic retention policies at the feed level, deleting unused feeds and package versions, and managing items in the recycling bin. Programmatic deletion using Feed Management APIs and protocol-specific package APIs is also covered. The post highlights setting cost limits through Azure Portal's cost management features and understanding billing for Artifacts.
  7. New with Azure Artifacts: public and project-scoped feedsIntroduced Public Feeds for sharing packages publicly without authentication and Project-Scoped Feeds for better organization within Azure DevOps. Also added a Feed Recycle Bin to store deleted feeds for up to 30 days, allowing restoration or permanent deletion. Performance improvements were made to backend services, resulting in significantly shorter load times for feeds.
  8. Share packages publicly from Azure Artifacts - Public PreviewAnnounces the public preview of public feeds in Azure Artifacts, enabling sharing of NuGet, npm, Maven, and Python packages with anyone on the internet without authentication. Anonymous access is read-only. The first 2 GB of public packages are free.
  9. Blocking malicious versions of event-stream and flatmap-stream packagesAzure DevOps has implemented blocking for specific malicious versions of the `event-stream` and `flatmap-stream` npm packages to prevent them from being downloaded or published to Azure DevOps feeds. This action is in response to a security advisory identifying harmful code in these packages that attempted to exfiltrate bitcoin wallet information. The blocked versions are `flatmap-stream` versions 0.1.0, 0.1.1, and 0.1.2, and `event-stream` version 3.3.6. Customers with these packages in their feeds will be contacted.
  10. Blocking malicious event-stream and flatmap-stream packagesAzure DevOps has implemented blocking for malicious versions of the `flatmap-stream` (0.1.0, 0.1.1, 0.1.2) and `event-stream` (3.3.6) npm packages to prevent them from being downloaded or published to Azure DevOps feeds. This action mirrors the steps taken by the npm package manager and Visual Studio Code to mitigate the risk of these packages attempting to exfiltrate bitcoin wallets. Customers with these packages in their feeds will be contacted, and the safest approach recommended is to remain on `event-stream` version 3.3.4.
  11. Getting started with Universal PackagesThis post introduces Universal Packages as a new feature for Azure Artifacts. It describes their purpose (storing arbitrary file collections), capabilities (large file support, deduplication, compression), use cases (scripts, data, tools), and basic CLI commands for publishing and downloading. It also details optimizations for upload and download speeds through parallel transmission and sub-file deduplication, and mentions future work on a caching mechanism.
  12. Universal Packages bring large, generic artifact management to VSTSIntroduces Universal Packages as a new capability within Azure Artifacts (formerly VSTS Package Management). These packages are designed for managing generic, versioned file sets (e.g., tools, build drops, AI training data) without the overhead of traditional package managers. Key benefits include versioning of file sets, client- and server-side deduplication, CLI management via VSTS CLI, and integration with existing feeds for access control. The feature is currently in preview.
  13. Use packages reliably with upstreams for VSTS feedsThis post introduces the 'upstream sources' feature for Azure Artifacts feeds, allowing users to configure other VSTS feeds or public registries (nuget.org, npmjs.com) as sources for packages. When a package is used from an upstream source, Azure Artifacts saves a copy, ensuring availability even if the upstream source becomes unavailable. This feature also provides a link back to the original upstream package. The post details the setup process for both VSTS-to-VSTS and public registry upstream sources. Additionally, a new 'Collaborator' permission level is introduced for feeds, distinct from 'Contributor' and 'Reader', to manage who can save packages from upstream sources.
  14. Visual Studio Team Services demonstrates how Microsoft Loves JavaThis post announces the public preview of Maven package type support for Java developers in Visual Studio Team Services (VSTS) and Team Foundation Server (TFS). It highlights the integration of Maven packages, the upcoming automatic authentication feature for Maven package management via a built-in Maven build task, and the availability of VSTS/TFS plug-ins for popular Java IDEs (Eclipse, IntelliJ IDEA, VS Code) with support for Git and TFVC version control. It also details deployment extensions for IBM and Red Hat platforms, integration with open-source tools like Jenkins, JaCoCo, Cobertura, JMeter, and SonarQube, and cloud deployment options to Azure App Service and Virtual Machines for Java web applications.
  15. Package Management: Maven Public PreviewThis post announces the public preview of Maven artifact hosting in VSTS Package Management. It details how account administrators can enable the feature and guides users on creating a new feed and connecting to it to host Maven artifacts. Future investments include enabling authentication from Maven VSTS Build tasks to Package Management feeds and retention policies for Maven artifacts.
  16. Nexus build extension for Team ServicesThis post introduces a new extension for Team Services and Team Foundation Server (TFS) that adds a build task to upload build artifacts to a Sonatype Nexus Server. This is particularly useful for builds not using Maven, as it doesn't require POMs. Users can specify repository information and the file to upload. The extension is open-sourced on GitHub.
  17. Spring cleaning: Package management updatesThis post announces several package management updates for Visual Studio Team Services (VSTS). Key improvements include: global availability of package management preview, filtering and performance enhancements in the web interface, the ability to permanently unlist packages, improved Team Build integration with diagnostic output for authentication issues, and an update to NuGet.exe on hosted build agents to version 3.3. Additionally, new options for package versioning in the NuGet Packager task are mentioned. Future work includes support for npm, NuGet features in TFS vNext, and package deletion.
  18. Announcing Package Management support for VSO/TFSThis post announces the new package management service for Visual Studio Online and Team Foundation Server. It introduces the concept of 'Feeds' as containers for packages (initially NuGet, extensible to others) with permission management. It highlights enterprise security and authentication integration with VSO/AAD, and seamless integration with build and release management tools. Package support starts with NuGet and plans to expand to NPM, Bower, Ivy, Maven, .zip, and CocoaPods.