Hardened libraries

Integrating with ActiveState Curated Catalog

ActiveState Curated Catalog provides curated open-source packages rebuilt from verified source code, scanned, signed, and maintained to address known vulnerabilities.

You can proxy and cache packages from your curated catalog through Cloudsmith by creating an ActiveState Curated Catalog upstream.

Cloudsmith provides quick-configure upstreams for the following libraries:

Maven (Java artifacts)
npm (Javascript artifacts)
Generic (Generic file artifacts)

Note
To successfully proxy and cache packages for a specific library, that library must be included in your ActiveState tier.

Upstream configuration

Form Field	Description
Name	A descriptive name for this upstream source. A shortened version of this name will be used for tagging cached packages retrieved from this upstream.
Priority	The weighting of the Upstream source. Upstream sources are selected for resolving requests by sequential order (1..n), followed by creation date.
Proxy URL	The URL for this upstream source. This must be a fully qualified URL including any path elements required to reach the root of the repository.
Proxy Only	Proxy requests through to upstream sources in order to match assets that are not present in this repository.
Cache and Proxy	Proxy the initial request for an asset through to the upstream source and then store (cache) resolved assets in this repository for future requests.
Verify SSL Certificates	If enabled, SSL certificates are verified when requests are made to this upstream. We recommend leaving this enabled for all public sources to help mitigate Man-In-The-Middle (MITM) attacks.
Authentication	Optional credentials that can be provided if the upstream is not publicly accessible. Note Authentication is required for all ActiveState Curated Catalog upstreams. Select Basic Auth, and enter: - Username: `activestate-repos` - Password: Your ActiveState registry credentials access token.
Headers (optional)	Optional key-value headers that can be passed to upstreams with each request.

Configure an ActiveState Curated Catalog upstream

In your Cloudsmith repository, go to the Sources tab.
Click Add upstream or + Configure new upstream.
In the Configure upstream window, click Libraries.
Click ActiveState Curated Catalog.
Select the library you want to proxy:
- npm
- Maven
- Generic
In the Name field, enter a descriptive name for the upstream.
In the Priority field, specify a priority for the upstream. For more information about upstream priority, see Upstream concepts: Priority.
The Proxy URL field is pre-filled with the corresponding ActiveState Curated Catalog URL for the library you selected. Replace <org-id> with your ActiveState Curated Catalog username (UUID format).
Under Package delivery, select Cache and proxy.
Under Authentication, select Basic Auth.

In the Username field, enter activestate-repos.
In the Password field, enter your ActiveState registry credentials access token.

Click + Add upstream.

Your ActiveState Curated Catalog upstream appears on the Upstream registries section of the Sources tab.

Pull a package through your ActiveState Curated Catalog upstream

To install an npm package through your ActiveState Curated Catalog upstream:

Configure a Curated Catalog upstream for npm by using the steps described in Configure an ActiveState Curated Catalog upstream.
In your Cloudsmith repository, select the Packages tab, then click Push/Pull Packages and choose the npm format.
Follow the steps shown to configure your .npmrc file with your Cloudsmith registry URL and API key.
Run npm install and verify that packages resolve through your Cloudsmith repository.

Pulling Generic packages
To pull packages through a Generic ActiveState upstream, you must include your upstream prefix as a path segment between your repository name and file path.
For example, if you set the Prefix to upstream when you configured your upstream:
bash
curl -sLf -u "token:YOUR-API-KEY" -O 'https://generic.cloudsmith.io/WORKSPACE/REPOSITORY/upstream/FILENAME.zip'

Updated 1 hour ago