Documentation
Book a demo

Integrations

Integrating with Chainguard Libraries

Chainguard Libraries, offered by Chainguard, are Maven, npm, and PyPI packages rebuilt from source.

Proxy and cache these libraries in Cloudsmith by configuring a Chainguard Libraries upstream. Remediated variants are also available for Maven and PyPI.

Upstream configuration

Form FieldDescription
NameA descriptive name for this upstream source. A shortened version of this name will be used for tagging cached packages retrieved from this upstream.
PriorityThe weighting of the upstream source. Upstream sources are selected for resolving requests by sequential order (1..n), followed by creation date.
Proxy URLThe URL for this upstream source. This must be a fully qualified URL including any path elements required to reach the root of the repository.
Proxy OnlyProxy requests through to upstream sources in order to match assets that are not present in this repository.
Cache and ProxyProxy the initial request for an asset through to the upstream source and then store (cache) resolved assets in this repository for future requests.
AuthenticationSelect the authentication method required by this upstream. If the upstream does not require credentials, select None from the dropdown.
Headers (optional, under Additional options)Optional key-value headers that can be passed to upstreams with each request.
Verify SSL Certificates (under Additional options)If enabled, SSL certificates are verified when requests are made to this upstream. We recommend leaving this enabled for all public sources to help mitigate Man-In-The-Middle (MITM) attacks.

Adding a Chainguard Libraries upstream

You can integrate a Chainguard Libraries registry into your Cloudsmith account by adding a Chainguard Libraries upstream.

Chainguard Libraries credentials

Authentication is required to access Chainguard Libraries. For instructions on retrieving a username and password for basic authentication, see Chainguard Libraries Access.

  1. In your Cloudsmith repository, go to the Sources tab.

  2. If you have existing upstreams configured, click + Configure new upstream.

  3. Select Chainguard Libraries.

  4. Select the library you want to proxy:

    • Maven (Java artifacts)
    • Maven (Remediated) (Java artifacts)
    • npm (JavaScript artifacts)
    • PyPI (Python artifacts)
    • PyPI (Remediated) (Python artifacts)

  5. In the Name field, enter a descriptive name for the upstream.

  6. In the Priority field, specify a priority for the upstream. For more information about upstream priority, see Upstream concepts: Priority.

  7. The Proxy URL field is pre-filled with the corresponding Chainguard Libraries URL for the library you selected.

  8. Under Package delivery, select Cache and proxy.

  9. Under Authentication, select Basic Auth, then enter the username and password from Chainguard Libraries Access. This is required for all Chainguard Libraries upstreams.

  10. (Optional) Under Additional options, in the Headers section, add key-value headers to pass to the upstream with each request.

  11. Click + Add upstream.

    Your Chainguard Libraries upstream appears on the Upstream registries section of the Sources tab.

Note

If you want to fall back to the public registry (Maven Central, npm, or PyPI) for packages not yet available from Chainguard Libraries, configure an additional upstream for that public registry with a lower priority than your Chainguard Libraries upstream.

Pull a Chainguard Libraries package

For example, to install an npm package through your Chainguard Libraries JavaScript upstream:

  1. Configure a Cloudsmith upstream for npm Chainguard Libraries by using the steps above.
  2. In your Cloudsmith repository, select the Packages tab, then click Push/Pull Packages and choose the npm format.
  3. Follow the steps shown to configure your .npmrc file with your Cloudsmith registry URL and API key.
  4. Run npm install and verify that packages resolve through your Cloudsmith repository.

Updating dependency integrity hashes

If you're migrating an existing project to Chainguard Libraries, your lockfile or dependency manifest may contain integrity hashes generated against packages from the public registry. See the Chainguard Libraries documentation for hash-update guidance specific to your language and package manager.