On 26 Apr 2021 at 18:03:19 BST, "TimS" <timstreater@greenbee.net>
wrote:

> On 26 Apr 2021 at 13:45:45 BST, Jaimie Vandenbergh
> <jaimie@usually.sessile.org> wrote:
>
>> On 20 Apr 2021 at 08:52:40 BST, "Chris Ridd" <chrisridd@mac.com> wrote:
>>
>>> On 18/04/2021 18:31, TimS wrote:
>>>> On 18 Apr 2021 at 15:32:03 BST, Chris Ridd <chrisridd@mac.com> wrote:
>>>>> And you will want to do these builds very often - multiple times while a
>>>>> single change is being reviewed and then committed. Sneakernet is not an
>>>>> option.
>>>>
>>>> You'd do all the reviewing on systems connected to the private off-Internet
>>>> lan. I'm sure a secure way can be found .
>>>
>>> Well that way you can't update your insecure dependencies in a review
>>> because you've added this extra hurdle. So swings and roundabouts.
>>
>> Last time I helped architect such a system, we had an internal server
>> (Artifactory) providing repositories of all the code and data we needed
>> to build and test our software. That did two things - made sure we could
>> always repeat an older build as we'd keep all the older dependencies,
>> and made sure that our actual build servers (Jenkins and the like) could
>> be on a private network with no internet access.
>>
>> There was a secure non-transitive route to the repo server for us ops to
>> add needed new things to it, after the obligatory infosec
>> automated+manual checks on incoming code and binaries.
>>
>> Worked pretty well, but made updating the infrastructure itself bloody
>> annoying on occasion, and a few software packages that "need" to phone
>> home for licensing etc had to be canned or their support shouted at long
>> enough to provide us with versions that don't do that.
>
> I'm surprised that this isn't the standard, routine way of doing things.

It's best practice, certainly. Lots of shops don't bother because it's
harder to set up than just putting everything on the corp network.

Cheers - Jaimie
--
"We don't stop playing because we grow old; we
grow old because we stop playing"
-- George Bernard Shaw