hushrun and JFrog Artifactory
Updated
JFrog Artifactory is an artifact repository, and promotion there moves a build or an image from one repository to another. hushrun works with the registry you already have, and decides whether an image may move, from signed evidence that the same files passed what the stage requires. Artifactory holds artifacts. hushrun plans the move.
| JFrog Artifactory | hushrun | |
|---|---|---|
| What it is | A repository for artifacts | A CLI in your CI, and hushrun's server |
| What promotion does | Moves or copies between repositories | Copies by digest, then deploys |
| What decides | With jf rt, your pipeline; JFrog AppTrust adds policy gates | A plan from signed evidence |
| Registries | Artifactory | The OCI registries you already use |
| Skips repeated checks | No | Yes |
How Artifactory promotes
jf rt build-promote moves a recorded build to a target repository, and moves by default rather than copying:
jf rt build-promote my-build 42 prod-localjf rt docker-promote does the same for one image. The source and target repositories must differ:
jf rt docker-promote api staging-docker prod-dockerEither runs when your pipeline runs it, so with these commands, working out whether the image is ready stays with the pipeline. JFrog's Evidence Management and AppTrust add signed evidence and policy gates inside its own platform.
How hushrun differs
- Your registries. hushrun copies between the registries you name in
hushrun.yaml, by digest. - It answers whether to promote. A stage's plan checks the evidence for this exact content: which checks passed, who signed them, what's still missing. Then it promotes, runs only what's left, or refuses.
- The record is signed. Every check, build and deploy is a signed event in an append-only log, and
hushrun verifyshows who signed each one.
Using both
They do different jobs, so you can use both: Artifactory holds the images, and hushrun decides and records. hushrun copies images over the standard registry API, with the credentials in your Docker configuration. We haven't tested that against Artifactory, so try it on one image first.
Which to choose
- Keep Artifactory if you need one repository for many package types.
- Add hushrun if you want the decision to promote made from evidence, and repeated checks gone.
- Use hushrun alone if your registries are enough, and you only need the promotion.