Sonatype secures the software supply chain and protects organizations' vital software development lifecycle(SDLC). The platform unites security teams and developers to accelerate digital innovation without sacrificing security or quality across the SDLC. With users among more than 2,000 organizations and 15 million software developers, Sonatype tools and guidance help users to deliver and maintain exceptional and secure software.
$0
for use of the Sonatype Nexus Repository Community Edition
GIT is good to be used for faster and high availability operations during code release cycle. Git provides a complete replica of the repository on the developer's local system which is why every developer will have complete repository available for quick access on his system and they can merge the specific branches that they have worked on back to the centralized repository. The limitations with GIT are seen when checking in large files.
- Guidance on remediation is very good - Vulnerability detection is very good - Support is very good - Ability to ask PMs/POs open questions at Office Hours every month is very good - Support for languages is lacking (TIOBE Index Top20) - Some features are un-neededly hidden and make the usage more complex then it needs to be
Nexus firewall is a great feature enabled for all our proxy repositories which are used to download the third-party opensource packages.
Nexus IQ is integrated with build stage to analyze the component against evaluation policy. This helps to figure out the application security standards.
Nexus IQ is also having a feature to scan container images before it uploads to our private repository. This is great feature for container platforms.
Git has met all standards for a source control tool and even exceeded those standards. Git is so integrated with our work that I can't imagine a day without it.
Sonatype supports more than 200 dev(s). It proves with the repository to store the artifacts. Allows for governance of open source software used by the different teams. It is used by security teams to scan for vulnerabilities in software(s) and in the deployed containers. It helps ensure code quality.
Overall experience is great with the Platform; however, I see some opportunity with upgrading the platform as it is missing with data of historical scans to allow reviewer to get view of trend how the application/product development team is considering fixing the issues.
Sonatype products are great value as I said but a few areas like how products use underlying resources in order to make it further lightweight, is something I would like them to consider.
I am not sure what the official Git support channels are like as I have never needed to use any official support. Because Git is so popular among all developers now, it is pretty easy to find the answer to almost any Git question with a quick Google search. I've never had trouble finding what I'm looking for.
I've used both Apache Subversion & Git over the years and have maintained my allegiance to Git. Git is not objectively better than Subversion. It's different. The key difference is that it is decentralized. With Subversion, you have a problem here: The SVN Repository may be in a location you can't reach (behind a VPN, intranet - etc), you cannot commit. If you want to make a copy of your code, you have to literally copy/paste it. With Git, you do not have this problem. Your local copy is a repository, and you can commit to it and get all benefits of source control. When you regain connectivity to the main repository, you can commit against it. Another thing for consideration is that Git tracks content rather than files. Branches are lightweight and merging is easy, and I mean really easy. It's distributed, basically every repository is a branch. It's much easier to develop concurrently and collaboratively than with Subversion, in my opinion. It also makes offline development possible. It doesn't impose any workflow, as seen on the above linked website, there are many workflows possible with Git. A Subversion-style workflow is easily mimicked.
Out of other products we evaluated before choosing Sonatype, the later looked far more user friendly, easy to understand and work with. This was key for us, as the tool needs to be used by many engineers that don't have security as their main focus. Having a tool that is easy to understand and work with, makes the process of evaluating open source dependencies much easier and appealing for developers.
Git has saved our organization countless hours having to manually trace code to a breaking change or manage conflicting changes. It has no equal when it comes to scalability or manageability.
Git has allowed our engineering team to build code reviews into its workflow by preventing a developer from approving or merging in their own code; instead, all proposed changes are reviewed by another engineer to assess the impact of the code and whether or not it should be merged in first. This greatly reduces the likelihood of breaking changes getting into production.
Git has at times created some confusion among developers about what to do if they accidentally commit a change they decide later they want to roll back. There are multiple ways to address this problem and the best available option may not be obvious in all cases.
