CRAVEX-integration: Integration with package repositories: Artifactory

We should integrate with Artifactory. The main scenario we care for is to scan "artifacts" stored in Artifactory.

There are two ways to get to these:

using the artifactory API which is not specific to any package type, just for a download
using the ecosystem-native API for a given package, where for instance Artifactory emulates PyPI or Maven

Then we care for authentication as Artifactory repos are often private.

So to recap we should implement 1) since 2) is already mostly taken care of in PurlDB/MineCode, with auth support using our existing support for .netrc, and having some minimal doc for that.

JFrog Artifactory and Sonatype Nexus integrations documentation added in Add JFrog Artifactory and Sonatype Nexus integrations documentation #1970
Support for PyPI PURLs as Inputs added in Add support for PyPI PURLs as Inputs #1966

Released as https://github.com/aboutcode-org/scancode.io/releases/tag/v35.5.0

New documentation available at https://scancodeio.readthedocs.io/en/latest/inputs.html#jfrog-artifactory and https://scancodeio.readthedocs.io/en/latest/inputs.html#sonatype-nexus

JFrog Artifactory
-----------------

ScanCode.io can fetch artifacts from **JFrog Artifactory** repositories using
standard download URLs.

The URL format follows Artifactory's REST API pattern::

    https://<artifactory-host>/artifactory/<repo-key>/<artifact-path>

Example::

    https://mycompany.jfrog.io/artifactory/libs-release/org/apache/commons/commons-lang3/3.12.0/commons-lang3-3.12.0.jar

For **authentication**, configure credentials in your ``.env`` file using one of
these methods:

Using Basic Authentication::

    SCANCODEIO_FETCH_BASIC_AUTH="mycompany.jfrog.io=username,password"

Using API Key (via headers)::

    SCANCODEIO_FETCH_HEADERS="mycompany.jfrog.io=X-JFrog-Art-Api=<YOUR_API_KEY>"

Using Access Token::

    SCANCODEIO_FETCH_HEADERS="mycompany.jfrog.io=Authorization=Bearer <YOUR_TOKEN>"

.. tip::
    You can also use a :ref:`.netrc file <scancodeio_settings_netrc_location>` for
    authentication if your organization already maintains one.

.. _inputs_nexus:

Sonatype Nexus
--------------

ScanCode.io can fetch artifacts from **Sonatype Nexus Repository** (versions 2 and 3)
using standard download URLs.

For **Nexus 3**, the URL format follows the repository path pattern::

    https://<nexus-host>/repository/<repo-name>/<path-to-artifact>

Example for a Maven artifact::

    https://nexus.mycompany.com/repository/maven-central/ch/qos/logback/logback-core/1.4.0/logback-core-1.4.0.jar

Example for a PyPI package::

    https://nexus.mycompany.com/repository/pypi-proxy/packages/urllib3/1.26.7/urllib3-1.26.7-py2.py3-none-any.whl

Example for an npm package::

    https://nexus.mycompany.com/repository/npm-proxy/redis/-/redis-2.8.0.tgz

For **authentication**, configure credentials in your ``.env`` file:

Using Basic Authentication::

    SCANCODEIO_FETCH_BASIC_AUTH="nexus.mycompany.com=username,password"

Using a Bearer Token::

    SCANCODEIO_FETCH_HEADERS="nexus.mycompany.com=Authorization=Bearer <YOUR_TOKEN>"

.. tip::
    You can also use a :ref:`.netrc file <scancodeio_settings_netrc_location>` for
    authentication if your organization already maintains one.

Navigation Menu

Repository navigation

CRAVEX-integration: Integration with package repositories: Artifactory #1725

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

CRAVEX-integration: Integration with package repositories: Artifactory #1725

Description

Activity

tdruez commented on Dec 1, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions