openartifact

OpenArtifact stores and serves npm, PyPI, Maven, Docker/OCI, Helm, Debian, RPM, Go, Cargo, NuGet, RubyGems, Conda, Conan, Ivy, sbt and raw files behind one URL scheme and one permission model, on your own infrastructure. Free software under the AGPL.

Formats

Repository type	Formats
Hosted	all 16 (listed above)
Proxy (read-only mirror of an upstream)	Maven, Debian, RPM, raw
Group (ordered members, first hit wins)	Maven, raw

Client URLs and setup per format: docs/formats.

Features

• Native client protocols for 16 formats; hosted, proxy (with serve-stale) and group repositories
• RBAC with users, groups, permission targets and API tokens; SSO via OIDC and SAML; projects
• SBOM (CycloneDX/SPDX), vulnerability scanning (OSV, Trivy, Grype), license compliance, secret detection
• Cleanup policies, storage quotas, artifact properties, release bundles with promotion pipelines
• Blob storage on filesystem, S3, GCS, Azure, Garage, SeaweedFS or an OCI registry; backups
• GPG-signed APT and RPM metadata; signed, attested release images
• Webhooks, audit log, Prometheus metrics, REST API with OpenAPI spec and Swagger UI
• oa CLI with Nexus/Artifactory import; optional MCP server and AI analysis (both off by default)

Quickstart

cp docker/.env.example docker/.env      # set POSTGRES_PASSWORD
make docker-up    # docker compose up -d --build with version/commit/build time stamped
                  # (no dhi.io access? OPENARTIFACT_RUNTIME=distroless make docker-up)

The UI and API are on http://localhost:8080. The first start creates user admin with a random password printed once to the server's stderr (docker compose -f docker/docker-compose.yml logs openartifact). Change it at first login.

On Kubernetes:

helm install openartifact oci://ghcr.io/openartifact/charts/openartifact

More: installation, configuration.

Documentation

Section	Contents
Getting started	Installation (Compose, Helm, binaries, first login), configuration (every setting), upgrading
Formats	Client URLs and setup per format: Maven, npm, PyPI, Docker, Helm, Debian, RPM, Go, Cargo, NuGet, RubyGems, Conda, Conan, Ivy/sbt, raw
Repositories	Hosted, proxy and group, cleanup and quotas, properties, release bundles
Security	Authentication, SSO, RBAC, scanning, signing and release verification
Operations	Storage, backup, monitoring, webhooks, performance
Migration	Import from Nexus or Artifactory with oa import
Integrations	oa CLI, MCP server, REST API, AI analysis
Development	Build, test, CI, architecture

The full page index is docs/README.md.

Contributing, security, license

• Contributing: CONTRIBUTING.md; conventions for humans and coding agents: AGENTS.md
• Security: report issues privately as described in SECURITY.md
• License: AGPL-3.0-or-later, see LICENSE