Operations | Monitoring | ITSM | DevOps | Cloud

November 2021

Continuous integration for .NET applications

.NET is a popular open source, cross-platform development framework for building fast and scalable full-stack applications for the web, desktop, mobile, and the cloud. This flexibility makes.NET a leading platform for developing enterprise web applications and makes.NET development one of the most in-demand skills on the market.

A Developer focused CI/CD pipeline for Kubernetes

As Kubernetes becomes the key target environment across many organizations, it automatically becomes an essential topic for developers. However, Kubernetes was created for operations and, unless you spend a considerable amount of time learning and specializing yourself, it is still challenging to use. Developers should rather focus on delivering applications instead, and a developer or application-focused platform is needed to enable that.

Managing code signing on CircleCI using the runner

Code signing is an important part of testing and distributing your desktop and mobile applications. It ensures that the end user’s system can verify the legitimacy of your application. Because of the need for security around signed certificates, they are stored locally and not uploaded to the cloud. This constraint could prevent your team from fully automating your CI/CD pipeline.

10 practices that are changing in software today with Alex Williams

Rob sits down with Alex Williams, founder and editor in chief of The New Stack, to discuss the several changes occurring in software development. Alex shares what he's been hearing on everything from API management to synchronizing supply chain to programmable infrastructure. Tune in today to find out how your team can stay ahead of the complexities of the ever-changing landscape of software.

Top 10 features of how to get the most out of your CI/CD

A CI/CD pipeline seems straightforward to implement and maintain. Yet it can often quickly become a tedious time sink and a source of universal frustration on many teams. From flaky builds, to long running builds, to flaky long running builds, the sources of frustration are endless. With the goal to ship more and faster as well as to compete in an ever changing industry, we can (and must) do better.

Building for Windows using the MSIX orb

The MSIX orb is the first “Windows-only” orb from CircleCI. When Microsoft approached us with the opportunity to build an orb that would help Windows developers build on our platform, we were enthusiastic. Most of our orbs, and general workload, revolve around Linux and utilize Bash. However, we recognized the deep need to provide good CI/CD solutions for building applications on Windows, and with use of PowerShell growing steadily within Linux, it was time to take the plunge.

Automated testing for NestJS GraphQL projects

NestJS is fast becoming the de facto framework for NodeJS projects. Unlike older frameworks, NestJS was built with TypeScript, which has become commonplace in the JavaScript community. Frameworks like NestJS seem to be preferred by teams that adopt TypeScript. NestJS supports building APIs in REST and GraphQL. The goal of this tutorial is to show how you can add unit and integration tests to a NestJS GraphQL project and automate the testing process with CircleCI.

Embrace your Updates

As developers, we’re passionate about creating and delivering high-quality software to our end-users and customers. Simply knowing that our software was shipped, deployed, and is being used is a great achievement. And it looks like we did a good job. Everything around us in our lives depends on high-quality software. Software needs to run for us to get water, energy, electricity, transportation, food, etc. Developers have a huge responsibility to keep this software updated and running efficiently.

Python Malware Imitates Signed PyPI Traffic in Novel Exfiltration Technique

The JFrog Security research team continuously monitors popular open source software (OSS) repositories with our automated tooling to report vulnerable and malicious packages to repository maintainers. Earlier this year we disclosed several malicious packages targeting developers’ private data that were downloaded approximately 30K times. Today, we will share details about 11 new malware packages that we’ve recently discovered and disclosed to the PyPI maintainers (who promptly removed them).

TensorFlow Python Code Injection: More eval() Woes

JFrog security research team (formerly Vdoo) has recently disclosed a code injection issue in one of the utilities shipped with Tensorflow, a popular Machine Learning platform that’s widely used in the industry. The issue has been assigned to CVE-2021-41228. This disclosure is hot on the heels of our previous, similar disclosure in Yamale which you can read about in our previous blog post.

Collapsing your model for the sake of product-market fit ft. Grant Miller

Rob sits down with Replicated co-founder and CEO, Grant Miller to discuss the evolution of orchestration and shifting fast to find product-market fit. Grant recalls a time when Replicated needed to change its model quickly to achieve the success it has today. Tune in to hear more of Grant's story!

Infrastructure as Code, part 3: automate Kubernetes deployments with CI/CD and Terraform

This series shows you how to get started with infrastructure as code (IaC). The goal is to help developers build a strong understanding of IaC through tutorials and code examples. In this post, I will demonstrate how to create continuous integration and deployment (CI/CD) pipelines that automate the Terraform IaC deployments covered in part 1 and part 2 of this series. Here is a quick list of things we will accomplish in this post.

Infrastructure as Code, part 2: build Docker images and deploy to Kubernetes with Terraform

This series shows you how to get started with infrastructure as code (IaC). The goal is to help developers build a strong understanding of IaC through tutorials and code examples. In this post, I will demonstrate how to how to create a Docker image for an application, then push that image to Docker Hub. I will also discuss how to create and deploy the Docker image to a Google Kubernetes Engine (GKE) cluster using HashiCorp’s Terraform.

Unboxing BusyBox - 14 new vulnerabilities uncovered by Claroty and JFrog

Embedded devices with limited memory and storage resources are likely to leverage a tool such as BusyBox, which is marketed as the Swiss Army Knife of embedded Linux. BusyBox is a software suite of many useful Unix utilities, known as applets, that are packaged as a single executable file. Within BusyBox you can find a full-fledged shell, a DHCP client/server, and small utilities such as cp, ls, grep, and others.

Infrastructure as Code, part 1: create a Kubernetes cluster with Terraform

This series shows you how to get started with infrastructure as code (IaC). The goal is to help developers build a strong understanding of IaC through tutorials and code examples. Infrastructure as Code (IaC) is an integral part of modern continuous integration pipelines. It is the process of managing and provisioning cloud and IT resources using machine readable definition files.

Embrace your updates - creating a world of daily software releases without fear!

Imagine a world where we would all enjoy updating the software we use. A world where software producers could be excited about releasing every day without fear. This is the future of 'liquid software', when updates, like water, run freely to all corners of the world. In this session, JFrog co-founder and chief data scientist Fred Simon will share his vision of achieving trusted continuous updates in the DevOps world, in which software is constant. He will show us why continuous software updates are critical for our modern world.

Announcing the JFrog Slack App for Artifactory and Xray Cloud

Imagine a world where every team member could directly contribute to software together. We’re living in that world now. With more than 10 million daily active users, Slack is one of the most ‘lived in’ collaboration tools used by software development teams around the world.

Migrate and Modernize: How to Upgrade Your DevOps as You Move to the Cloud

Understand how to transform your IT with AWS infrastructure and JFrog DevOps. Join our webinar to learn how JFrog and AWS can help you transform your DevOps and infrastructure to a more nimble and secure environment. In this webinar, you will gain insight on the strategies and best practices to overcome the challenges of legacy infrastructure and older application build and deployment approaches. In this webinar you will discover.

Display your continuous integration build status on Jira

Automating tests and deployments with infrastructure (CI/CD) more productive. Instead of managing multiple tools and manual processes, all they have to do is commit the code to a code repository. Not everyone on a project visits the CI/CD system, but they may need to know when the build process fails or is successful. This is where a proper handshake between CI/CD systems and project management tools such as Jira shines.

Bitbucket Cloud has landed in AWS

In July and August of this year, I revealed to our community for the first time that Bitbucket Cloud was engaged in a project to migrate to a new platform. As I wrote in July: I am thrilled to announce that, in late August, we officially completed this project and Bitbucket Cloud has been operating in AWS, data center-free for over 2 months. So how does this benefit our customers? This is one of the most technically complex projects we've ever tackled as a team.

CI/CD and state management for Flutter apps with MobX

MobX is a scalable library developed to ease the process of state management in frontend applications. In this tutorial, you will learn how to manage the state of your Flutter applications using MobX, and then set up a continuous integration/continuous deployment (CI/CD) pipeline for your application using CircleCI. You can find the sample project developed for this tutorial in this GitHub repository.

Datadog Cloudsmith Integration

Cloudsmith is happy to announce an integration with Datadog to help our customers monitor their Cloudsmith account. Datadog is an observability service for cloud-scale apps, providing monitoring of servers, databases, tools, and services through a SaaS based data analytics platform. At Cloudsmith we are big fans of Datadog and use it to monitor and visualize how our system is performing across a range of services and tools.

Announcing the Bitbucket Cloud Migration Assistant

We are excited to announce the launch of the Bitbucket Cloud Migration Assistant (BCMA). The BCMA is an Atlassian-supported app built to help Bitbucket Server customers automate the migration process from Bitbucket Server to Bitbucket Cloud. If you are considering a move to Bitbucket Cloud, this is the easiest way to get started. Download the BCMA from the Atlassian marketplace.