Product

Overview

How it works Watch it work All 35 features Screenshots How ForgeRepo™ is secured

Keep bad packages out

Malware scanning Typosquat detection Dependency confusion protection Cooling off new releases Allow lists and block lists

When something goes wrong

Kill switch Who has it Lockdown and degraded modes Vulnerability monitoring

Developers and approvals

Requests and auto approve Check, walk and review Waivers Dry run
Formats

Languages

Private npm registry PyPI proxy and private index Private NuGet feed and proxy Maven repository proxy RubyGems mirror Composer and Packagist proxy

Apple, containers and Linux

CocoaPods CDN mirror Swift package registry Docker registry mirror RPM mirror for dnf and yum APT mirror for Debian and Ubuntu

Use it as

An npm firewall Artifacts, SBOMs and lifecycle More than one node SSO, roles and allow lists
Learn

Guides

Learn secure development Secure coding Secure pipelines Unsafe vs safe Security and development

Supply chain

Supply chain attacks, 2016 to 2026 Software supply chain security
Compare Side by side, all four ForgeRepo™ vs JFrog ForgeRepo™ vs Sonatype ForgeRepo™ vs Cloudsmith
Docs

Start

Getting started Download All documentation Questions

For developers

npm setup pip setup docker login Push a Docker image CI basics

For administrators

First setup Rules and their order Six incidents, walked through Backup and upgrade
Pricing Install it
  1. Home
  2. Documentation

Documentation

The same guides the portal ships with

Every ForgeRepo™ has these two guides built in under Docs, written for the reader's role, with your own address in every example. Here they are on the web, with packages.example.com standing in for yours. 97 topics, searchable as you type.

Press / to jump into the box and Esc to clear it.

Showing all 97 topics.

Developer Guide

Point npm, pip and docker at ForgeRepo™, set up CI, publish, and what to do when something is blocked.

Start here

1 What ForgeRepo™ does for you One address for every package and image your code uses, checked before it reaches your laptop or your pipeline.
2 Signing in and finding your way around Sign in, see what your role can do, and change your password.

Access tokens

3 Make a token A token lets npm, pip, docker and your pipelines prove who they are.
4 Revoke a token, or check when it was used See your tokens, when they expire, and revoke the ones you no longer use.

npm, pnpm and Yarn

5 Set up npm Point npm at packages.example.com for one project or for your whole machine.
6 Install packages with npm npm install and npm ci work the same way they always have.
7 Set up pnpm pnpm uses the same registry and token settings as npm.
8 Set up Yarn Yarn 2 and later read .yarnrc.yml instead of .npmrc.

Python

9 Set up pip Point pip at the ForgeRepo™ index.
10 Install Python packages pip install and requirements files work as usual.
11 Set up uv uv reads the index from UV_INDEX_URL.
12 Set up Poetry Add packages.example.com as the primary source and give Poetry the token.

Container images

13 Sign docker in to packages.example.com Use your token as the password for docker, podman or skopeo.
14 Pull an image Put packages.example.com/ in front of the image name.
15 Build with a base image from packages.example.com Change the FROM line and log in before you build.
16 npm or pip inside a docker build Give the build your token without saving it in the image.
17 Docker Compose Use the packages.example.com names in compose.yaml.
18 Kubernetes and containerd Give the cluster a pull secret made from a token.
19 Image scanning and "try again in a minute" Why a new image can make docker wait, and why a vulnerable one can be refused.
20 Push an image Push your own images under the names your admin reserved.

.NET and NuGet

21 Set up dotnet Point dotnet, nuget.exe and Visual Studio at the ForgeRepo™ NuGet feed.
22 Add and restore packages Add a package and restore a project, the same as with nuget.org.
23 NuGet in a pipeline Add the feed with one command and restore.

Java, Maven and Gradle

24 Set up Maven Point mvn at the ForgeRepo™ Maven repository with a mirror in settings.xml.
25 Set up Gradle Use the ForgeRepo™ repository in build.gradle.
26 Version ranges and releases A range picks the newest version the rules allow. Snapshots are not served.

Ruby, gem and Bundler

27 Set up Bundler Send every gem through ForgeRepo™ with a Bundler mirror, and keep your Gemfile as it is.
28 Set up gem install Make packages.example.com the only gem source for gem install.
29 When bundler cannot find a gem A gem nobody approved yet looks like it does not exist.

iOS and CocoaPods

30 Set up CocoaPods Point your Podfile at the ForgeRepo™ CocoaPods CDN, and give pod your token in ~/.netrc.
31 When pod cannot find a pod A pod nobody approved yet is not listed.

Swift packages

32 Set up SwiftPM Point SwiftPM at the ForgeRepo™ package registry and log in with your token.
33 When SwiftPM cannot get a package A package nobody approved is refused, and swift prints why.

PHP and Composer

34 Set up Composer Point Composer at the ForgeRepo™ repository in place of Packagist, and give it your token.
35 When Composer cannot find a package A package nobody approved is not listed, so Composer says it could not be found.

Linux packages (dnf and yum)

36 Set up dnf and yum Point dnf at a ForgeRepo™ mirror of your distro with a .repo file, and give it your token.
37 When dnf cannot get a package A package the rules refuse is either not listed or refused on download.

Linux packages (apt)

38 Set up apt Point apt at a ForgeRepo™ mirror of Debian or Ubuntu, and give it your token.
39 When apt cannot get a package A package the rules refuse is refused on download, and apt prints why.

CI pipelines

40 Pipelines: the short version One token per pipeline, kept in the pipeline secrets, and the same commands as your laptop.
41 GitHub Actions setup-node, pip and docker login in a GitHub workflow.
42 GitLab CI Job images, npm and pip in .gitlab-ci.yml.
43 Jenkins, Azure Pipelines and others Any CI system works the same way: a secret and the setup commands.

Publishing

44 Publish an npm package Publish company packages under the names your admin reserved.
45 Publish a Python package Upload wheels and source archives with twine.
46 Publish a NuGet package Push a .nupkg with dotnet nuget push.

Blocked packages and requests

47 When something is blocked Read the reason, then ask for the package or pick a different version.
48 Ask for a package or image Send a request to the approvers, and follow what happens to it.
49 Check before you install See what the rules say about a version, and everything it pulls in.
50 Review a whole lock file Upload a lock file, an SBOM or a software inventory and see what the rules make of every package, of every type.
51 Ask for a waiver Keep using a version with a known advisory, for a limited time, with a reason on record.
52 See known vulnerabilities Which allowed versions have advisories, including packages inside images.

For approvers

53 Decide on requests Approve, block or clear what developers asked for.

Troubleshooting

54 Troubleshooting The errors people hit most, and how to fix them.
55 Security habits that help Small habits that keep your code and your company safe.

Administrator Guide

How ForgeRepo™ decides what gets through, how to set it up, and how to run it day to day and during an incident.

How it works

1 How ForgeRepo™ works One registry for npm, PyPI and container images that checks every download against your rules and your security settings.
2 Applications, environments and token scope Tokens carry an application and environment, and rules and waivers can apply to just those.

First setup

3 First setup checklist The settings to review before developers start using ForgeRepo™.
4 Upstream registries and package types Where ForgeRepo™ fetches from, how names are routed, and the Docker Hub address.
5 Require tokens Make every npm, pip and docker client prove who it is.
6 Name, branding and email Make the portal look like yours and let it send mail.

People and access

7 Users and roles Add people, pick their role, unlock them, and act as them to see what they see.
8 Single sign-on Sign in with your OpenID Connect provider and map its groups to roles.
9 Managing every token See every token, who owns it, where it is used, and revoke any of them.
10 Portal allow list and break glass Hide the portal from networks you do not trust, with an emergency way back in.

Rules and approvals

11 Whitelist, blacklist and audit mode Choose whether unknown packages are blocked or allowed, and how to switch safely.
12 Writing rules Patterns, version ranges, priority and scope, and how the winning rule is chosen.
13 Deciding requests Where requests come from and what approve, block and clear do.
14 Auto approve Let clean requests approve themselves, and keep anything risky for a person.
15 Deciding waivers Let a version through a vulnerability, license or cooling off check for a limited time.
16 Dry run a change before you make it Replay recent downloads against a new rule, vulnerability threshold or license list.

Security protections

17 Vulnerabilities and safe version resolution Keep known vulnerable versions out of installs automatically.
18 Cooling off new releases Hold brand new versions for a few days, when most malicious releases are caught.
19 Malware scanning Scan every downloaded file with a hash blocklist, ClamAV, the known-malicious feed or your own scanner.
20 Quarantine and integrity alerts Files held for review, and files whose contents changed after they were first seen.
21 Licenses, lookalikes and provenance License rules, typosquat detection, and signed build provenance.

Images and publishing

22 NuGet feeds Mirror nuget.org or a private feed for dotnet and Visual Studio, with the same checks as npm and PyPI.
23 Maven repositories Mirror Maven Central or a private repository for mvn, Gradle and sbt, with the same checks as the other types.
24 Gem sources Mirror rubygems.org or a private gem source for Bundler and gem install, with the same checks as the other types.
25 CocoaPods CDNs Mirror the CocoaPods CDN for pod install. The code of each pod is fetched and scanned by this box.
26 Swift package registry Answer SwiftPM as a package registry over a git host. Each version tag is fetched once, kept and scanned.
27 Composer repositories Mirror Packagist for composer. The archive of each release is fetched and scanned by this box.
28 RPM mirrors Mirror distro repositories like AlmaLinux 9 BaseOS for dnf and yum. Every package is checked and scanned.
29 APT mirrors Mirror Debian and Ubuntu archives for apt. Every package is checked and scanned.
30 Container images Mirror images from Docker Hub and other registries, scan what is inside, and refuse vulnerable ones.
31 Reserved names and publishing Protect internal package names from dependency confusion and let CI publish them.

Incident response

32 The kill switch Stop a malicious package everywhere at once and find everyone who has it.
33 Consumers and SBOMs Answer "who uses this package" and export a bill of materials per application.
34 Registry modes: degraded and lockdown Slow or stop what comes in from outside during an ecosystem wide incident or an outage.
35 Scenarios: what happens, and what you do Real incidents walked through step by step.

Watching the system

36 The dashboard What each card means and where it leads.
37 Traffic, resolutions and the audit trail Every registry request, every version left out, and every change made in the portal.
38 Integrations: webhooks, Splunk and syslog Send security events to your SIEM or chat tools.

Operations

39 Cache, storage and retention Where files live, how long things are kept, and how to clean up.
40 Backups, import and export Move rules and configuration between servers, and back up the database.
41 Upgrades, health and high availability Upgrade safely, roll back, monitor health, and run more than one node.
42 Settings reference Every policy setting in one place, with its default.

Getting started

Install, proxy, first sign in, and pointing clients at it, with replays of each.

Start here

Questions

What people ask before and after they install it.

Read them

The README

The long form reference in the repository, down to database tables.

Open the source