English

JFrog Artifactory

Use Aikido Registry Proxy as the default upstream for Artifactory. The proxy blocks malware and enforces a minimum package age on every package your team installs.

The same Artifactory setup also lets you install Aikido Libraries.

  1. Get your Aikido proxy URL

    Go to Settings > Registry Proxy, select your ecosystem and copy the upstream proxy URL

  2. Create a Remote Repository in Artifactory

    1. In Artifactory, go to Administration > Repositories.
    2. Click New Repository and select Remote.
    3. Set Package Type
    4. Give the repository a key, for example aikido.
    5. Set the URL field to your Aikido proxy URL from step 1.
    6. Save the repository.

    If packages don't reflect the latest data from Aikido, set the Metadata Cache Lifetime to 0 in the remote repository settings. This forces Artifactory to always fetch fresh metadata from the Aikido proxy instead of serving a cached version.

  3. (Optional) Create a Virtual Repository

    If you also have internal packages stored in a local Artifactory repository, create a Virtual Repository that aggregates both:

    1. Go to Administration > Repositories > New Repository > Virtual.
    2. Set Package Type to match your remote repository
    3. Add your local repository and the remote repository as members.
    4. Point your package manager at the virtual repository URL instead.

    This gives your team a single registry endpoint that serves both internal packages and externally proxied packages through Aikido.

  4. Configure Developer Machines to use Artifactory

    Point each developer's package manager at the Artifactory repository. See JFrog's documentation for the exact steps:

  5. (Optional) Block the public registry with Device Protection

    Once Artifactory is in place, developers can still bypass it by pointing their package manager directly at the public registry. Deploy Aikido Device Protection to enforce that all traffic goes through your private registry.

    Block Public Package Registries