JFrog Artifactory
Authenticate FOSSA against your private Artifactory registry so it can resolve dependencies during analysis.
Overview
When FOSSA analyses a project, it resolves dependencies from the same registries your build tool uses. If your team proxies public packages through Artifactory (or hosts private packages there) you need to give FOSSA credentials so it can fetch those dependencies too.
Configure private registry credentials under Account Settings → Languages. Each language has its own settings page.
How it works
FOSSA passes the credentials you configure here to the relevant package manager fetcher at analysis time. For Maven, it injects a custom settings.xml; for npm it sets the registry URL and auth token; for other languages it follows the same pattern. Credentials are stored encrypted and never appear in logs or scan output.
Supported languages
| Language | Settings page | Auth method |
|---|---|---|
| Java (Maven) | /account/settings/languages/java | Repository URL + Server credentials (ID, username, password) |
| JavaScript (npm) | /account/settings/languages/npm | Registry URL + token or username/password |
| Python (pip) | /account/settings/languages/python | Repository URL + username/password |
| Rust (Cargo) | /account/settings/languages/rust | Registry URL + token or username/password |
| Ruby (Gems) | /account/settings/languages/ruby | Source URL + username/password |
| .NET (NuGet) | /account/settings/languages/dotnet | Source URL + username/password |
Configuring Java (Maven)
Java uses two separate config sections that mirror Maven's settings.xml: Repositories define where to fetch packages from, and Servers supply the credentials for those repositories. The Repository ID and Server ID must match.
- 1
Add a repository
Go to Account Settings → Languages → Java and click Add Repository.
Field Value ID An identifier you choose (e.g. artifactory-central)URL Your Artifactory virtual repository URL (e.g. https://artifactory.yourcompany.com/artifactory/libs-release) - 2
Add a server
Click Add Server and fill in the credentials for the repository you just added.
Field Value ID Must exactly match the Repository ID from the previous step Username Your Artifactory username or service account name Password Your Artifactory password or API key - 3
Save
Click Save Settings. FOSSA will use these credentials when it fetches Maven dependencies for your projects.
Note
Add one entry per Artifactory virtual repository. If you have separate repos for releases and snapshots, add both with matching server entries.
Configuring other languages
For all other supported languages, the settings page has a single section: add a registry or repository URL and supply credentials. The specific field names differ slightly by language but the pattern is the same.
- 1
Open the language settings page
Go to Account Settings → Languages and select your language from the sidebar.
- 2
Add your Artifactory registry URL
Enter the Artifactory virtual repository URL for that package type. Examples:
Language Example Artifactory URL format npm https://artifactory.yourcompany.com/artifactory/api/npm/npm-virtual/pip https://artifactory.yourcompany.com/artifactory/api/pypi/pypi-virtual/simpleCargo https://artifactory.yourcompany.com/artifactory/api/cargo/cargo-local/Ruby Gems https://artifactory.yourcompany.com/artifactory/api/gems/gems-virtual/NuGet https://artifactory.yourcompany.com/artifactory/api/nuget/nuget-virtual/ - 3
Enter credentials
Supply a username and password (or API key), or a token if the language settings page offers that option (npm and Cargo both support token auth). Click Save Settings.
Note
If you see
npm ERR! Unable to authenticate, need: Basic realm="Artifactory Realm"after saving, switch from username/password to a token. Some Artifactory configurations require token auth for npm even when basic auth works for other package types.