Skip to main content

Integrate with artifact repositories

Artifact repositories provide a central location to host or proxy packages. We recommend integrating Package Firewall with artifact repositories to centralize access control for both internal and external packages.

  • Hosted repositories: store internal packages securely and control who can publish or download packages.
  • Proxy repositories: cache packages from public registries while applying firewall policies to ensure that only approved packages are available to developers.

This approach simplifies policy enforcement, improves security, and provides a single point for monitoring package activity.

Package Firewall supports configuration of JFrog Artifactory, Sonatype Nexus Repository, and Azure Artifacts.

For details on how to integrate each package manager, see Integrate with package managers.

Configure JFrog Artifactory​

Artifactory supports both local and remote repositories. Local repositories store and serve internal packages, while remote repositories retrieve packages from external sources, such as third-party repositories. For example, in the Python ecosystem, PyPI is a remote repository that your Artifactory instance can access.

The Package Firewall acts as a remote repository that proxies requests to the actual package registry, such as PyPI or npm. It ensures that any packages entering your organization’s Artifactory comply with the defined policy for acceptable use of open-source libraries and packages.

Create a new remote repository​

Set up a remote repository to route package requests through Package Firewall's policy enforcement.

To complete this task:

  1. Sign in to Artifactory.
  2. Select Repositories > Administration
  3. At the top-right corner, select Create a Repository > Remote.
  4. To apply a firewall policy, select a supported package repository.
  5. For Repository Key, enter a name for your remote repository.
  6. For User Name, enter Veracode.
  7. For Password/Access Token, enter the Package Firewall access token.
  8. For URL, enter the Veracode registry URL for your ecosystem.
  9. Under the Advanced tab, select the checkbox next to Lenient Host Authentication. This setting ensures that redirects (for example, HTTP 301) are allowed and that repository requests succeed.
  10. To save your settings, select Create Remote Repository.

Update a virtual repository​

Virtual repositories in Artifactory overlay all local and remote repositories, providing a single host for configuration. This makes the decision-making process for pulling a package from your local or remote artifacts opaque to the end user.

Update your virtual repository to include the Package Firewall remote repository so developers use it for all package requests.

To complete this task:

  1. Sign in to Artifactory.
  2. Navigate to Repositories > Administration and locate your virtual repository.
  3. Select the virtual repository you want to update.
  4. In your virtual repository, navigate to Repositories.
  5. To remove the existing remote, under the Selected Repositories section, select the checkbox next to the remote repository name and select the green arrows that point to the left.
  6. To add your firewall remote repository, under the Available Repositories section, select the checkbox next to the remote repository name and select the green arrows that point to the right.
  7. To save your settings, at the bottom right of the screen, select Save.

Configure Cargo with Artifactory​

Point your Cargo client to your Artifactory remote repository so that all package requests route through Package Firewall.

To complete this task:

  1. Create a remote repository. Registry URL must match the contents of URL.

  2. Open the Cargo configuration file in a text editor. The file is located in the Cargo home directory, for example ~/.cargo/config.toml.

  3. Add the following code snippet to point your Cargo client to Artifactory:

     [registries.artifactory]
     index = "sparse+https://<JFrogPlatformURL>/artifactory/api/cargo/<REPO_NAME>/index/"

     [source.crates-io]
     replace-with = "artifactory"

    where:

    • JFrogPlatformURL: Organization's Artifactory URL
    • REPO_NAME: The name of your Cargo repository

  4. To sign in to Cargo, run the following command:

    printf "-:<ACCESS_TOKEN>" | base64

  5. Generate the Artifactory token and copy it.

  6. Run the following command cargo login --registry artifactory and paste the Artifactory token.

  7. To test that the firewall is configured correctly, run:

    cargo add serde

Configure Golang with Artifactory​

Point your Go client to your Artifactory remote repository so that all package requests route through the Package Firewall.

To complete this task:

  1. Create a remote repository.
  2. Create a virtual repository and add the remote repository that you created earlier.
  3. To configure Golang with Artifactory, see here.
  4. To test that the firewall is configured correctly, run: 
    go get google.golang.org/protobuf/proto

Configure Maven with Artifactory​

Point your Maven client to your Artifactory remote repository so that all package requests route through the Package Firewall.

To complete this task:

  1. Create a remote repository.
  2. Generate the Artifactory token and copy it.
  3. To configure Maven with Artifactory, see here.
  4. Run the following command: 
    mvn -s settings.xml dependency:resolve

Configure npm with Artifactory​

Point your npm client to your Artifactory remote repository so that all package requests route through the Package Firewall.

To complete this task:

  1. Create a remote repository.

  2. Run the following command:

    npm [config -L] project set registry https://<JFrogPlatformURL>/artifactory/api/npm/<REPO_NAME>/

    where:

    • JFrogPlatformURL: organization's Artifactory URL
    • REPO_NAME: name of your npm repository
    • config -L: sets location to the .npmrc file in the current project

  3. To sign in to Artifactory, run the following command and follow the prompts:

    npm login --auth-type=web

  4. To test that the firewall is configured correctly, run:

    npm install lodash

Configure NuGet with Artifactory​

Point your NuGet client to your Artifactory remote repository so that all package requests route through the Package Firewall.

To complete this task:

  1. Create a remote repository.
  2. Generate the Artifactory token and copy it.
  3. To configure NuGet with Artifactory, see here.
  4. Run the following command in the command line: 
    dotnet nuget disable source nuget.org
  5. To test that the firewall is configured correctly, run: 
    dotnet add package Newtonsoft.json

Configure PyPI with Artifactory​

Point your PyPI client to your Artifactory remote repository so that all package requests route through the Package Firewall.

To complete this task:

  1. Create a remote repository. Ensure that you copy the contents of URL into Registry URL.
  2. Generate the Artifactory token and copy it.
  3. To configure PyPI with Artifactory, see here.
  4. To test that the firewall is configured correctly, run: 
    poetry add requests

Configure RubyGems with Artifactory​

Point your RubyGems client to your Artifactory remote repository so that all package requests route through the Package Firewall.

To complete this task:

  1. Create a remote repository.

  2. Generate the Artifactory token and copy it.

  3. Run the following command:

    bundle config set --global mirror.https://rubygems.org https://<JFrogPlatformURL>/artifactory/api/gems/<REPO_NAME>
    bundle config set --global mirror.https://rubygems.org.fallback_timeout 9999

    where:

    • JFrogPlatformURL: Organization's Artifactory URL
    • REPO_NAME: The name of your RubyGems repository

  4. Run the following command:

    bundle config set --global <JFrogPlatformURL> <REPO_NAME>:<ARTIFACTORY_TOKEN>

    where:

    • JFrogPlatformURL: Organization's Artifactory URL
    • REPO_NAME: The name of your RubyGems repository

  5. To test that the firewall is configured correctly, run:

    bundle add nokogiri

Configure Sonatype Nexus Repository​

Nexus Repository supports both hosted and proxy repositories. Hosted repositories store and serve internal packages, while proxy repositories retrieve packages from external sources such as third-party registries. For example, in the Python ecosystem, PyPI is a proxy repository that your Nexus Repository instance can access.

The Package Firewall acts as a remote repository that proxies requests to the actual package registry, such as PyPI or npm. It ensures that all packages entering your organization’s Nexus Repository comply with the defined policy for acceptable use of open-source libraries and packages.

Create a new proxy repository​

Set up a proxy repository to route package requests through the Package Firewall's policy enforcement.

To complete this task:

  1. Sign in to Nexus Repository.
  2. To create a proxy repository for the firewall, select the gear icon to open the admin UI, select Repositories, and then Create Repository.
  3. Select the proxy version of the package repository to which you want to apply the policy. See the current Package Firewall supported ecosystems.
  4. For Name, enter a name for your proxy repository.
  5. For Remote storage, enter the Package Firewall registry URL for the ecosystem you're configuring.
  6. Reduce the values in Maximum metadata age and Not found cache TTL. With the default value of 1440 minutes, changes to whether a package is allowed or blocked by policy might take up to an additional day.
  7. In the HTTP section, turn on username authentication.
  8. For Username, enter Veracode.
  9. For Password, enter the Package Firewall access token.

Update a group repository​

Group repositories in Nexus Repository combine all hosted and proxy repositories, giving you a single host to use in your configuration. This approach simplifies package retrieval for end users by abstracting whether artifacts come from hosted or proxy sources.

Update your group repository to include the Package Firewall proxy repository so developers use it for all package requests.

To complete this task:

  1. Sign in to Nexus Repository.
  2. To update a repository, select the gear icon to open the admin UI, then select Repositories. Select the repository to update.
  3. In your group repository, navigate to Member repositories.
  4. To remove the existing proxy, under the Members section, select the proxy and select the arrow pointing to the left.
  5. To add your firewall proxy repository, under the Available section, select the proxy repository and select the arrow pointing to the right.
  6. To save your settings, at the bottom of the screen, select Save.

Configure Azure Artifacts​

Azure Artifacts supports both hosted repositories and proxy repositories.

note

Package Firewall only supports npm due to Azure Artifacts limitations.

Before you begin:

To complete this task:

  1. Sign in to Azure DevOps and navigate to your public project.
  2. Select Artifacts, then select your public feed from the dropdown menu.
  3. To open your Feed settings, select the Settings icon.
  4. Select the Upstream Sources tab, then select Add Upstream.
  5. In Type, select Public source.
  6. In the Public source dropdown, select Custom registry.
  7. In Public source URL, enter https://npm.firewall.veracode.com/aviary/internal/pauth/<firewall access token>/. In Upstream source name, add an appropriate name.
  8. Select Add, then save your upstream and delete the official npmjs upstream.
  9. Connect your feed to Package Firewall.

Supported ecosystems​

The following table lists the supported ecosystem registries and their corresponding custom Veracode registry URLs.

Set up Package Firewall to use these artifact repositories or package managers.

EcosystemVeracode registry URL
Cargohttps://cargo.firewall.veracode.com
Golanghttps://golang.firewall.veracode.com
Mavenhttps://maven.firewall.veracode.com
NPMhttps://npm.firewall.veracode.com
NuGethttps://nuget.firewall.veracode.com
PyPIhttps://pypi.firewall.veracode.com
RubyGemshttps://rubygems.firewall.veracode.com
Last updated on