constructs
notation
constructs | notation | |
---|---|---|
4 | 7 | |
387 | 290 | |
1.3% | 1.4% | |
9.4 | 8.9 | |
1 day ago | 8 days ago | |
TypeScript | Go | |
Apache License 2.0 | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
constructs
-
Cloud, why so difficult? 🤷♀️
To "meet developers where they are" is a beautiful tenet of AWS, and of the CDK, and inspired us to create awesome technology such as JSII and constructs.
-
Projecting templating with CDK
I agree with constructs, I recommend using both (article mentions). Create your template, you might have various CDK constructs (community, AWS, personal), the template will produce a full project how you / your org want it. This might include your github actions for linting, cdk synth, testing, deployment etc. Application source (Lambda, API, container etc). Anyone in your team or external should be able to take that template and produce a project that is the same.
-
Dagger: a new way to build CI/CD pipelines
Have you heard of or explored https://github.com/aws/constructs (related: https://github.com/aws/jsii and https://github.com/aws/aws-cdk)?
This is what CDK uses for declarative modeling, but gives the opportunity to use languages/tooling that most devs are already familiar with. CDK8s already uses it as a replacement for yaml (technically, the yaml becomes an implementation detail rather than actually replaced)
-
Projen: The Next CDK Suprise!
All CDKs are based on Amazon's Constructs, (which also uses projen). They come with a CLI and Development Kit (API). In short, you set up an Object in code and then synthesize the representation to disk. This opens up the full power of programming languages. If you are sick of the issues with terraform, CloudFormation Templates, troposphere, Azure Blue Prints, or the like then this is for you.
notation
-
Securing CI/CD Images with Cosign and OPA
Notary v2: The evolution to Notary v2 brought improvements in signature portability and integration with third-party key management solutions. However, it does not provide a certificate authority, leaving public key discovery for open-source image verification as an unresolved issue.
-
Automating Kubernetes Deployments with FluxCD for Patched and Signed Container Images
Notation
-
Level-up Container Security: 4 Open-Source Tools for Secure Software Supply Chain
Notation is another command-line too that lets you digitally sign artifacts. And those signatures essentaily become the stamps of approval for the different things in your software supply chain. For example, container images.
- notaryproject/notation: Notation is a project to add signatures as standard items in the registry ecosystem, and to build a set of simple tooling for signing and verifying these signatures. Based on Notary V2 standard.
-
Getting Started with Notary
Notary is the CNCF project name and is often referenced when referring to the process of signing digital artifacts, but Notation is the command line tool that does the heavy lifting. Run the following commands to install Notation.
- Dagger: a new way to build CI/CD pipelines
-
Making the Internet more secure one signed container at a time
It should be interoperable, that's the goal. I proposed some idea for nv2 here: https://github.com/notaryproject/nv2/issues/39 and here: https://github.com/notaryproject/nv2/issues/40 too.
What are some alternatives?
dagger - Application Delivery as Code that Runs Anywhere
cosign - Code signing and transparency for containers and binaries
earthly - Super simple build framework with fast, repeatable builds and an instantly familiar syntax – like Dockerfile and Makefile had a baby.
net-monitor - The sample net-monitor software, used as samples in Notary v2 (https://github.com/notaryproject/notaryproject)
projen - Rapidly build modern applications with advanced configuration management
ratify - Artifact Ratification Framework
jsii - jsii allows code in any language to naturally interact with JavaScript classes. It is the technology that enables the AWS Cloud Development Kit to deliver polyglot libraries from a single codebase!
grafeas - Artifact Metadata API
awesome-projen - P6M7G8's Awesome Projen
secure-supply-chain-on-aks - Learn how to use open-source tools to secure your container deployments on Azure Kubernetes Service.
research - Language research sketchbook
distribution - distribution with reference types