Artifactory

Software today is rarely built from scratch. Almost every program is assembled from many finished components written by other people. Such components are called artifacts: ready-packaged files that a program can use. Artifactory is a warehouse for exactly these files. It collects them in one place, manages them, and hands them out to everyone who needs them. It is developed by the Israeli-American company JFrog, and in many large companies it is the central tool for this task.

Why companies need a central warehouse for components

A medium-sized program can easily use several hundred foreign components. These are normally scattered across public servers on the internet. Every time the program is assembled, they would have to be downloaded anew. That is slow, and it only works as long as the foreign servers are reachable. If one goes down, development grinds to a halt.

A central warehouse solves this problem. Artifactory fetches a component from the internet once and keeps a copy. The next time, it comes from the company’s own network and arrives in a fraction of a second. This saves time and makes the company less dependent on external servers.

Then there is security. Foreign components sometimes contain security vulnerabilities or even deliberately planted malicious code. A central warehouse is the one point where everything can be checked before it enters the company. It also makes it possible to trace which program used which version of a component. When the Log4Shell security vulnerability appeared in 2021 in a widely used Java component, this exact question was, for days, the most urgent one in many companies.

How the warehouse takes in and hands out components

Artifactory works with three kinds of storage areas, called repositories in technical jargon. Local repositories contain what the company has built itself. Remote repositories are mirrors of public sources from the internet. Virtual repositories combine several of these into a single address, so that developers only need to know one address.

The process is simple. A developer or an automated server requests a particular component in a particular version. Artifactory first checks its own stock. If it finds nothing, it fetches the file from the internet, creates a copy, and delivers it. The next time, it answers immediately from its own stock.

An important point is the distinction from an ordinary file store. Artifactory understands the formats used by different programming languages, such as Maven for Java or npm for JavaScript. It also knows container images, meaning fully packaged programs along with their environment. For each component, it stores additional information: who uploaded it, which source code it came from, which checks it passed.

Artifactory in companies and in the news

As a regular user, you will never see Artifactory directly. It runs in the background of development departments. But anyone doing an internship in software development will almost certainly come across it. It usually sits between the source code storage and the server that delivers the finished program.

In business news, the manufacturer JFrog appears regularly. It went public on the US technology exchange Nasdaq in 2020 and belongs to the group of vendors that sell software development tools. Competitors include Sonatype Nexus and GitHub’s package management.

A second topic is the security of software supply chains. Governments and authorities increasingly demand that companies be able to provide a list of all foreign components used. This list is called a Software Bill of Materials, or SBOM for short. Tools like Artifactory are the obvious place where such lists are generated. This is also becoming relevant for AI projects: trained models and datasets are likewise large files that need to be managed and versioned.