harbor

Harbor is boring infrastructure doing its job. OCI-conformant, ships real vulnerability scanning, policy-based replication, LDAP/OIDC integration, proper signed releases with Cosign verification. No novel algorithms—it's solving the actual problem of "we need a private registry that doesn't suck." The badge collection is excessive but earned: FOSSA, OpenSSF, CII practices, passing conformance tests. Code is real Go, CI runs hard tests. This is what wins in production: reliability over novelty...