Configure a repository manager for Chainguard Libraries

Index endpoints for direct client use: Java https://libraries.cgr.dev/java/; Python https://libraries.cgr.dev/python/simple/; JavaScript https://libraries.cgr.dev/javascript/ (trailing slash required). Authenticate with a pull token.

Artifactory - JavaScript

When you create the javascript-chainguard remote repository, on the Advanced configuration tab check Disable URL Normalization, then create the repository.

Then, for redirect handling, apply these settings on the remote:

• Enable "Bypass HEAD Requests".
• Disable "Lenient Host Authentication" so credentials are not forwarded across the redirect.
• Enable "Cookie Management" (optional; recommended by JFrog for redirect-based remotes).
• After changing settings, right-click the javascript-chainguard repository, select "Zap Caches", then re-run your install.

Artifactory - Python

• Set the Registry URL to https://libraries.cgr.dev/ (do not include /python in the URL).
• Set the PyPI Registry Index Location URL Suffix to python/simple.
• Check "Disable URL Normalization" and disable "Block Mismatching Mime Types".

Other repository managers

Documented repository managers are JFrog Artifactory, Sonatype Nexus, and Cloudsmith. Google Artifact Registry is a documented, supported option for Java and Python; it is not an officially supported repository manager for JavaScript (a working configuration is documented, but unsupported). Harbor has no documented configuration.