Dear dbt community,
because of recent supply-chain incidents regarding third-party packages we can no longer download and install third party libraries from public registries, like dbt-hub, PyPi, npm etc.
Now for Python packages we use a Proxy, no issues there. But as per the dbt documentation we can only upload dbt dependencies to our proxy as a tarball, which the proprietary scanning tools of our proxy can not “scan”, thus making us unable to comply to security regulations. Therefore we cannot, at this moment, serve dbt-hub packages to our projects.
Now my question is, is there a way to serve the dbt-hub packages through a public registry? Like PyPi, instead of dbt’s dependency manager, tarball, or github reference.
Any other recommendations are also very much welcome!
Thanks in advance!
Kind regards, Henk-Jan