Mirroring hex.pm libraries to provide them internally as well

[imsoulfly]

The idea is to have an additional repository mirroring hex.pm next to the one consisting of your private libraries

• similar configuration for handling second repository
• basic mirroring functionality of whole hex.pm
• mirroring only specified libraries
• regular scans for new version of existing libraries
• mirroring of libraries including their dependencies
• Possibly not a full copy initially with all versions of a lib (10 latest version and cleanup of older version if space is restricted)
• on demand mirroring of missing versions and/or libraries

[Calamari]

Is there a registry available that checks up versions against a list of know SEC-Vulnurabilities? If yes, it would be also nice to display those known risks along the versions.

[imsoulfly]

There were at least some ideas floating around but things haven't got into motion it seems.

1. https://elixirforum.com/t/creating-a-public-vulnerabilities-database/13467
2. https://elixirforum.com/t/create-hex-pm-vulnerability-disclosure-feature/15905/11

Currently there is only the hex registry that could tell if versions of a library are retired see here
When I start the mirroring development I need to check how it's provided by hex.pm

[imsoulfly]

Some news with regards to vulnerabilities:

1. https://github.blog/2022-06-27-github-advisory-database-now-supports-erlang-and-elixir-packages/
2. https://github.com/advisories

So that's good news, I will have a look on how to integrate this.

[Calamari]

Uuh, nice. Good to know :-)

[imsoulfly]

First stage of simple/stupid mirror was just released into main branch: cb69a6c

Further implementing the automatic dependency tree resolution in the next steps :-)