This article is part of a series on Migrating from Artifactory to ProGet, also available as an eBook.

Artifactory can be used to store and manage build artifacts, in other words, files you’ll be deploying later. It’s also used to store and track build metadata, including OSS libraries & components used. 

ProGet can also manage build artifacts and metadata. However, the technical approach is quite different, as ProGet is a modern package manager rather than just a file server like Artifactory.

This article will break down the difference in how Artifactory and ProGet handle build artifacts and build metadata. It will also show you how to migrate build info from Artifactory to ProGet with SBOMs, and integrate ProGet into your CI Server.

Build Artifacts in Artifactory and ProGet 

As we talked about in our article on Files and Packages, Artifactory was launched nearly twenty years ago as a kind of “Maven2 proxy repository with advanced features”, and despite changes and updates, it’s still just a Maven repository acting as a file server at it’s core. It’s a somewhat outdated solution consisting of folders that are considered “builds”, with a “POM” file that contains the build’s metadata. Files can be freely added or deleted in these folders, similar to a shared drive.

Unlike Artifactory, ProGet uses packages instead of files for build artifacts. This is by far a better solution, providing built-in support for versioning and dependency management. What’s more, they cannot be changed once uploaded. Packages are cryptographically sealed, and you can store the package’s hash external to ProGet.

To store these build artifacts in ProGet you could use a Maven feed, Although a much better approach would be to store them as Universal Packages in a Universal Package Feed. Universal Packages are a single zip file archive that strictly follows semantic versioning standards. They have a manifest file with strict requirements, but also allow you to add your own metadata. 

How Build Metadata & OSS Dependencies are Tracked 

Whereas build artifacts are tangible files in repositories (such as binaries, libraries and, executables), build metadata is information about the build, primarily its OSS dependencies. These are often called SBOMs, and are tracked in a different place to build artifacts themselves.

In Artifactory, build metadata is handled in specifically-formatted repositories called “buildInfo”, while, ProGet stores build metadata in “Builds and Projects“. Conceptually “Builds and Projects” is similar to a “BuildInfo” repository in Artifactory, but functions differently. 

Migrating Your BuildInfo from Artifactory to ProGet 

Migrating BuildInfo from Artifactory to ProGet is pretty easy. Both Artifactory and ProGet allow the import and export of SBOMs. So getting your BuildInfo from Artifactory to ProGet is a simple case of exporting it as an SBOM in Artifactory, and importing it into ProGet. 

Once your builds are in ProGet, you might also want to set up permissions like your builds in Artifactory. ProGet user permissions are not set to Builds or Projects. Instead, you’ll associate Projects with Feeds and apply feed permissions to these projects. 

How ProGet Integrates with a CI Server 

You can integrate your ProGet instance easily with your CI Server using pgutil, ProGet’s CLI tool. pgutil’s CLI can be used in a similar manner to JFrog’s CLI or Artifactory plugins. However, unlike in Artifactory where you compile your code and then “publish” a build, you’ll run pgutil after compiling the code. 

Like with Artifactory CI Server integrations, pgutil also handles other operations as well. In both cases, integration is relatively simple and involves editing a build script, pipeline, or template. 

Manage Your Builds in ProGet Easily 

Like Artifactory, ProGet can manage build artifacts, although the technical approach is a little different. ProGet serves as a modern package manager rather than just a file server like Artifactory, and treats build artifacts as packages instead of files.

ProGet also manages build metadata in “Builds and Projects”, which acts similarly to a BuildInfo repository in Artifactory. Migrating your build metadata is just a simple case of generating SBOMs in Artifactory and importing them into ProGet. pgutil can also be used to integrate ProGet into your CI Server, by running it after compiling your build code. 

This article is part of our eBook on Migrating from Artifactory to ProGet, which walks you through everything from setting up users and security to managing your repositories and much more. Download your free copy of “Migrating from Artifactory to ProGet” today!