artifact-keeper - Open-source universal artifact registry. Drop-in A

项目说明

Artifact Keeper

![CI]()
![Quality Gate]()
![Security Rating]()
![]()
![Lines of Code]()
![Rust]()
![Docker]()
![Sponsor]()

An enterprise-grade, open-source artifact registry supporting 45+ package formats. Built with Rust.

Documentation | Demo | Website

Highlights

System Architecture

Backend Architecture

The backend follows a layered architecture with a middleware pipeline processing every request.

Supported Package Formats

45+ formats organized by ecosystem. Each has a nati handler that speaks the package manager's wire protocol.

Languages & Runtimes

| Format | Aliases | Ecosystem |
|--------|---------|-----------|
| Maven | Gradle | Ja, Scala |
| NPM | Yarn, Bower, pnpm | Ja, TypeScript |
| PyPI | Poetry, Conda, JupyterLab Extensions | Python |
| NuGet | Chocolatey, PowerShell | .NET, C# |
| Cargo | | Rust |
| Go | | Go modules |
| RubyGems | | Ruby |
| Hex | | Elixir, Erlang |
| Composer | | PHP |
| Pub | | Dart, Flutter |
| CocoaPods | | iOS, macOS |
| Swift | | Swift Package Manager |
| CRAN | | R |
| SBT | Ivy | Scala, Java |

Containers & Infrastructure

| Format | Aliases | Ecosystem |
|--------|---------|-----------|
| Docker / OCI | Podman, Buildx, ORAS, WASM OCI, Helm OCI | Container images |
| Helm | | Kubernetes charts |
| Terraform | OpenTofu | Infrastructure modules |
| | | |

System Packages

| Format | Ecosystem |
|--------|-----------|
| RPM | RHEL, Fedora, CentOS |
| Debian | Ubuntu, Debian |
| Alpine | Alpine Linux (APK) |
| Pacman | Arch Linux (hosted) |
| Conda | Conda channels |
| OPKG | OpenWrt, embedded Linux |

Configuration Management

| Format | Ecosystem |
|--------|-----------|
| Chef | Chef Supermarket |
| Puppet | Puppet Forge |
| Ansible | Ansible Galaxy |

ML / AI

| Format | Ecosystem |
|--------|-----------|
| HuggingFace | Models, datasets |
| ML Model | Generic ML artifacts |

Editor Extensions

| Format | Aliases | Ecosystem |
|--------|---------|-----------|
| VS Code | | Extension marketplace (VS Code, Cursor, Windsurf, Kiro) |
| JetBrains | | Plugin repository |

Schemas

| Format | Ecosystem |
|--------|-----------|
| Protobuf / BSR | Buf Schema Registry, Connect RPC |

Other

| Format | Ecosystem |
|--------|-----------|
| Conan | C, C++ |
| Git LFS | Large file storage |
| Bazel | Bazel modules |
| P2 | Eclipse plugins |
| Generic | Any file type |

> Custom formats can be added via the WASM plugin system.

Security Scanning Pipeline

Every artifact upload is automatically scanned for known .

> Container-image scanning (TRI). The base docker-compose.yml
> wires TRI for the legacy tri* (filesystem / incus rootfs
> scanning) only. To get first-class Tri*image* reports, set
> TRI (e.g. ) so the backend
> registers the dedicated ImageScanner against the in-repo
> scanner-adapter (Harbor Pluggable Scanner
> API). Without it, images are still covered by grype (registry mode) but no
> Tri report is produced. Uncomment the TRI line and the
> scanner-adapter service in docker-compose.yml to enable it.
>
> Incus/LXC image scanning is enabled by default whene Trivy URL is
> configured. Set INCUS_SCANNER_ENABLED=false to leave that scanner out of the
> scanner registry when the deployment does not accept Incus images. This does
> not disable Tri or container-image scanning.
>
> The adapter pulls images back from the registry, so it must be told an
> address of the backend that is reachable *from the adapter container* —
> localhost is not, since the adapter itself listens on :8080 in its own
> network namespace (#3169). When nothing is configured the backend now
> ad its own container address automatically; set
> TRI (or the shared AK_GRYPE_REGISTRY_HOST) to
> o, e.g. . The automatic deri is skipped
> when the adapter's own URL is a loopback address, because that normally means
> the adapter shares this network namespace (cargo run next to a local
> adapter, or network_mode: host). It is not skipped correctly for an
> adapter container published on loopback (docker run -p 127.0.0.1:8081:8080
> …scanner-adapter): there the backend reaches the adapter o but
> the adapter cannot reach the backend that way, so set
> TRI explicitly. The backend logs which fallback it
> took on every scan. Give the adapter its own trivy
> cache — reusing the tri's root-owned tri fails
> with permission denied on fanal/fanal.db because the adapter runs
> unpri (UID 1001).
>
> Not-applicable scanners. A scanner that does not apply to an artifact's
> format (e.g. the filesystem/incus/openscap scanners on a Docker image) records
> a not_applicable result — a benign terminal state, distinct from failed.
> The scan-list API folds multiple not_applicable results for the same
> artifact into a single summary row (collapsed_not_applicable_count +
> collapsed_scan_types) so they read as one muted "not applicable" indication
> rather than N failures.

Borg Replication

Recursi replication where every node is a full Artifact Keeper instance. No thin caches — each peer runs the same stack and can serve as an origin for other peers.

WASM Plugin System

Extend Artifact Keeper with custom format handlers compiled to WebAssembly.

Quick Start

Get running in 5 minutes with Docker Compose: Quickstart Guide

Documentation

Project Structure

Technology Choices

| Layer | Choice | Why |
|-------|--------|-----|
| Backend language | Rust | Memory safety, performance, strong type system |
| Web framework | Axum | Tower middleware ecosystem, async-first |
| Database | PostgreSQL 16 | JSONB for metadata, mature ecosystem |
| Search | OpenSearch | Fast full-text search, easy to operate |
| Security scanning | Trivy + Grype + OpenSCAP | Complementary co, industry standard |
| Plugin runtime | Wasmtime | Sandboxed, portable, WIT contract system |
| Storage | Filesystem / S3 | Simple default, cloud-ready upgrade path |

CI/CD Pipeline

Se Actions workflows handle testing, publishing, and deployment.

| Workflow | Trigger | What It Does |
|----------|---------|--------------|
| ci.yml | Every push/PR | Lint, unit tests, integration tests, smoke E2E (PyPI, npm, Cargo) |
| docker-publish.yml | Push to main, tags | Multi-arch Docker images (backend + OpenSCAP) to ghcr.io |
| e2e.yml | Manual or called by release | Full E2E: 10 nati formats, stress, failure injection |
| release.yml | Tags v* | E2E gate, cross-platform binaries, GitHub Release |
| scheduled-tests.yml | Daily 2 AM UTC | Nightly smoke E2E, dependency check, security scan |
| site.yml | Push to site/** | Build and deploy docs to GitHub Pages |
| ami-build.yml | On release published | Bake AWS AMI with Packer |

Sponsors

Thank you to our sponsors for supporting ongoing de of Artifact Keeper.

Backers

<table>
<tr>
<td align="center"><a href=" src=" width="60" /><br />_{<b>Ash A.</b>}</a></td>
<td align="center"><a href=" src=" width="60" /><br />_{<b>Gabriel Rodriguez</b>}</a></td>
</tr>
</table>

Become a sponsor to support the project and get your name listed here.

Contributing

We welcome contributions! See CONTRIBUTING.md for guidelines.

Ha or ideas? Join the con in GitHub Discussions.

License

MIT License - see LICENSE for details.

---

Built with Rust. "JFrog" and "Artifactory" are trademarks of JFrog Ltd. Artifact Keeper is not affiliated with or endorsed by JFrog.

项目信息

开发语言：Rust

Star 数：1107

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Open-source universal artifact registry. Drop-in Artifactory/Nexus alternative with 40+ package formats, security scanning, WASM plugins, and edge replication.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。