GeezerVison

Self-hosted artifact repository for many package formats.
One Go binary, embedded web UI, PostgreSQL. Free software under the AGPL-3.0-or-later.

npm · PyPI · Maven · Docker/OCI · Helm · Debian · RPM · Go · Cargo · NuGet · RubyGems · Conda · Conan · Ivy · sbt · raw

• Hosted, proxy and group repositories behind one URL scheme and one permission model
• Projects; RBAC with scoped tokens, OIDC and SAML SSO
• Release bundles with promotion pipelines
• Federation between instances; blob replication, rebuild from storage and a disaster recovery runbook
• Declarative configuration from YAML with oa apply
• Signed APT and RPM metadata; vulnerability (OSV, Trivy, Grype), license and secret scans; CycloneDX/SPDX SBOMs
• Storage: filesystem, S3, GCS, Azure, OCI
• Webhooks, cleanup policies, quotas, audit log, backups, Prometheus metrics, OpenTelemetry
• White-label branding; MCP endpoint for AI agents
• Fuzzing with ClusterFuzzLite; signed releases with SBOM and build provenance

docker pull ghcr.io/openartifact/openartifact:latest
helm install openartifact oci://ghcr.io/openartifact/charts/openartifact

On AWS, with Terraform or OpenTofu:

module "openartifact" {
  source  = "openartifact/openartifact/aws"
  version = "~> 0.1"
  # vpc_id, subnets, certificate_arn, allowed_ingress_cidrs: see the module README
}

The oa CLI is on the releases page for Linux, macOS and Windows (amd64, arm64):

curl -fsSL https://github.com/openartifact/openartifact/releases/latest/download/oa_<version>_linux_amd64.tar.gz | tar -xz oa

Docs: installation · configuration · CI integrations · all docs

Contributing: CONTRIBUTING.md · Security: SECURITY.md