OpenArtifact

Self-hosted artifact repository for 16 package formats.
One Go binary, embedded web UI, PostgreSQL. Free software under the AGPL-3.0-or-later.

npm · PyPI · Maven · Docker/OCI · Helm · Debian · RPM · Go · Cargo · NuGet · RubyGems · Conda · Conan · Ivy · sbt · raw

Hosted, proxy and group repositories behind one URL scheme and one permission model
Projects; RBAC with scoped tokens, OIDC and SAML SSO
Release bundles with promotion pipelines
Federation between instances; blob replication, rebuild from storage and a disaster recovery runbook
Declarative configuration from YAML with oa apply
Signed APT and RPM metadata; vulnerability (OSV, Trivy, Grype), license and secret scans; CycloneDX/SPDX SBOMs
Storage: filesystem, S3, GCS, Azure, OCI
Webhooks, cleanup policies, quotas, audit log, backups, Prometheus metrics, OpenTelemetry
White-label branding; MCP endpoint for AI agents
Fuzzing with ClusterFuzzLite; signed releases with SBOM and build provenance

Repositories


openartifact	Server, web UI, `oa` CLI. Issues and pull requests go here.
helm-charts	Helm chart: `oci://ghcr.io/openartifact/charts/openartifact`
openartifact.github.io	Website and versioned documentation
brand	Logos, colours, type and usage guide (CC-BY-SA-4.0)
openartifact-plugin	Jenkins plugin: upload artifacts, create bundles, promote releases, build badges
drone-openartifact	Drone and Woodpecker plugin: upload artifacts and promote releases
saml	Fork of crewjam/saml used by the server: large signed assertion fix for goxmldsig 1.6

docker pull ghcr.io/openartifact/openartifact:latest
helm install openartifact oci://ghcr.io/openartifact/charts/openartifact

The oa CLI is on the releases page for Linux, macOS and Windows (amd64, arm64):

curl -fsSL https://github.com/openartifact/openartifact/releases/latest/download/oa_<version>_linux_amd64.tar.gz | tar -xz oa

Contributing: CONTRIBUTING.md · Security: SECURITY.md