# hushrun and JFrog Artifactory

JFrog Artifactory is an artifact repository, and promotion there moves a build or an image from one repository to another. hushrun works with the registry you already have, and decides whether an image may move, from signed evidence that the same files passed what the stage requires. Artifactory holds artifacts. hushrun plans the move.

| | JFrog Artifactory | hushrun |
|---|---|---|
| What it is | A repository for artifacts | A CLI in your CI, and hushrun's server |
| What promotion does | Moves or copies between repositories | Copies by digest, then deploys |
| What decides | With `jf rt`, your pipeline; JFrog AppTrust adds policy gates | A plan from signed evidence |
| Registries | Artifactory | The OCI registries you already use |
| Skips repeated checks | No | Yes |

## How Artifactory promotes

[`jf rt build-promote`](https://docs.jfrog.com/integrations/docs/manage-builds) moves a recorded build to a target repository, and moves by default rather than copying:

```bash
jf rt build-promote my-build 42 prod-local
```

[`jf rt docker-promote`](https://docs.jfrog.com/artifactory/docs/docker-advanced-operations) does the same for one image. The source and target repositories must differ:

```bash
jf rt docker-promote api staging-docker prod-docker
```

Either runs when your pipeline runs it, so with these commands, working out whether the image is ready stays with the pipeline. JFrog's Evidence Management and AppTrust add signed evidence and policy gates inside its own platform.

## How hushrun differs

- **Your registries.** hushrun copies between the registries you name in `hushrun.yaml`, by digest.
- **It answers whether to promote.** A stage's plan checks the evidence for this exact content: which checks passed, who signed them, what's still missing. Then it promotes, runs only what's left, or refuses.
- **The record is signed.** Every check, build and deploy is a signed event in an append-only log, and `hushrun verify` shows who signed each one.

## Using both

They do different jobs, so you can use both: Artifactory holds the images, and hushrun decides and records. hushrun copies images over the standard registry API, with the credentials in your Docker configuration. We haven't tested that against Artifactory, so try it on one image first.

## Which to choose

- **Keep Artifactory** if you need one repository for many package types.
- **Add hushrun** if you want the decision to promote made from evidence, and repeated checks gone.
- **Use hushrun alone** if your registries are enough, and you only need the promotion.

## Related

- [Promote a Docker image between environments](https://hushrun.com/docs/guides/promote-docker-image.md)
- [hushrun and Kargo](https://hushrun.com/docs/compare/kargo.md)