Internal shared libraries for the city’s cloud apps must stay in a controlled package repository, while carefully vetted open-source dependencies may come from public registries. What distinction should the platform team enforce?
Select an answer to reveal the explanation.
Short Explanation
Keep the city’s own libraries in a private package repo—like a locked supply closet. Public registries are fine for vetted open source, but don’t dump internal code out on the sidewalk. Governance on what is public versus private saves embarrassing leaks.
Full Explanation
DevOps artifact strategy separates internal proprietary packages, which belong in private repositories with access control, from open-source dependencies retrieved via public or organization-proxied registries under policy. Publishing internals publicly by default, avoiding repositories entirely, or using public registries for citizen private backups violates least-exposure and supply-chain hygiene expectations.