OpenArtifactSelf-hosted artifact repository for many package formats

One Go binary, embedded web UI, PostgreSQL. Hosted, proxy and group repositories with RBAC, SSO and security scanning.

Get started

Documentation

GitHub

Native package formats

npm, PyPI, Maven, Docker/OCI, Helm, Debian, RPM, Go, Cargo, NuGet, RubyGems, Conda, Conan, Ivy, sbt and raw files, each on the URL its client expects.

Hosted, proxy and group

Mirror upstreams with serve-stale, merge repositories behind one URL, and replicate hosted repositories between sites.

Access control

Users, groups, permission targets and API tokens, SSO through OIDC and SAML, and projects that own repositories.

Supply chain security

CycloneDX and SPDX SBOMs, vulnerability, secret and license scanning, quarantine, Dependency-Track, signed and attested releases.

Operable

Filesystem, S3, GCS, Azure or OCI blob storage with tiering and replication, backups, point-in-time recovery, Prometheus metrics, webhooks and an audit log.

Free software

AGPL-3.0-or-later, REUSE compliant. REST API with an OpenAPI spec, an oa CLI with Nexus and Artifactory import, and an optional MCP server.

Dashboard: repository counts, repositories by format, recent activity

npm repository with published package versions