JFrog can now welcome Dart developers to the empowerment of Artifactory’s robust binaries management and the ways that it contributes to continuous integration. We’ve added Pub, the package manager for Dart, to the long list of package types Artifactory supports for both local, remote, and virtual repositories.
What has Dart got that GitHub ranked it #1 as the fastest growing language in 2019, after a year’s 532% usage increase? And how can you use Pub repositories in Artifactory to accelerate your software development lifecycle?
Why Dart and Pub?
Dart has been gaining greater adoption by developers, and rose into the top 10 ranking in Stack Overflow’s 2021 developer survey of most loved technologies. GitHub has ranked it as one of the 10 high-demand languages for 2022. Flutter has grown significantly since its introduction, with a notable contributor increase in 2021.
With its standards governed by ECMA International, Dart offers these benefits for client-based applications:
- Fast startup: Dart programs compiled into snapshot files that contain pre-parsed code and dependencies that are ready to execute.
- Concurrency: Dart apps run in one or more isolates, where tasks run in independent environments with their own memory.
When combined with Flutter and/or Angular, Dart enables developers to quickly and reliably produce UI-based apps that can operate across many mobile and web-based platforms.
Remote Pub Repositories
As a Dart developer, you’ll rely on the growing pub.dev package repository for Flutter, Angular, and many other core services.
To help assure uninterrupted speed and consistency of your Dart builds and Flutter or Angular apps across teams, use an Artifactory remote repository to proxy pub.dev.
A remote repository in Artifactory serves as a read-only caching proxy for a repository or registry managed at a remote URL. There will be no difference between the contents of the remote repo and the native source.
When you put this best DevOps practice to work, you and your team gain:
- Locality for speed — The proxy pulls and keeps the packages you use frequently into the compute environment where your builds happen, whether in the cloud or on-prem, minimizing network latency and bypassing throttling limits.
- Connection protection — Your pub.dev proxy remains available even when the pub.dev server isn’t due to a poor or interrupted connection, or if the remote server itself suffers an outage.
- Immutability enforcement — Once a package version is in the proxy, it’s unchanging and the same in every build that uses it. This guards against anything sneaking into your builds through an improper forced push into or malicious supply chain attack on the public repo.
It’s easy to set up a remote repository proxy for pub.dev:
- Create a new Pub remote repository in Artifactory
- Name the remote repository and assign the URL for pub.dev
- For Dart to access your repository from your workstation, you will need to generate an access token to authenticate your Artifactory user account.Use “Set Me Up” in the Artifact Browser to obtain the correct URL for your remote Pub repository, and follow the instructions to add your access token to the pub tool (using the
dart pub token addcommand), and redirect resolution of hosted dependencies to the Artifactory remote repo through the Pub environment variable.
Following this successful setup, all of your Dart dependencies will be resolved from your proxy in Artifactory instead of directly from pub.dev. (See the section below on virtual repositories for an alternative configuration.)
Local Pub Repositories
For the private Dart packages that you will create and share only within your team or department, you should maintain local Pub repositories in Artifactory. You can create as many as you need, and specify their URLs in your pubspec file for your dependencies.
For example, a team working on “Project X” might set up and use a local Pub repo:
- Create the local Pub repository in Artifactory named “pub-local-projectx”
- Use the
dart pub token addcommand to add your Artifactory access token to the pub tool.
- In the
pubspec.yamlfile of your private package, use the
publish_toproperty to specify the private repo in Artifactory. Then run the
dart pub publishcommand to publish your Dart package to Artifactory.
- To use the package that is now in the Artifactory private repo as a dependency in your Project X application source code, use the
hostedkeyword where you specify the dependency source in the application’s
Virtual Pub Repositories
With Artifactory, you can combine any set of local and/or remote repositories into a virtual repository that acts as a single, logical repository that can be accessed through a common URL.
For example, you can maintain separate repositories for Project X, Project Y, and Project Z, but create a virtual repository that can conveniently access all three repos through a single, secure URL. You can also balance convenience with security by creating a virtual repo that includes Projects X and Y, another virtual repo that includes Projects X and Z, and use Artifactory’s fine-grained permissions to control who can access them and how.
You can also combine into a virtual repo any or all of your private Pub repositories with your remote repository for pub.dev, to create a single-access URL for all hosted dependencies. In this case, you would set the
PUB_HOSTED_URL environment variable to the virtual Pub repo’s URL to make it the default for resolving Dart dependencies.
Since the virtual repo is a distinct URL, you will also need to add your Artifactory access token to the pub tool using
dart pub token add for that URL.
For example, to use a
pub_virtual virtual repository that combines your
pub_remote repositories to resolve all hosted dependencies:
With strategic use of remote, local, and virtual repositories for Pub in Artifactory by Dart developers, you’ll be putting to work some of the most important best practices for your SDLC to enable DevOps success. You can ensure consistency across all your Dart developer teams for dependencies and packages, with native Pub, Flutter, and AngularDart support that doesn’t get in their way. And you can also govern access across teams with Artifactory’s fine-grained permissions system.
Try Artifactory’s Pub repositories for yourself and see! You can start putting these methods into practice with a free JFrog cloud account!