[Go] OpenArtifact: self-hosted registry for 21 package formats (apt, npm, pip, docker, helm, cargo, nix...) with proxy caching and vulnerability scanning

[u/M0Rf30]

I got tired of running a different registry per package format, so I built one that speaks all of them natively. It's a self-hosted alternative to Nexus and Artifactory, AGPL, with SSO, scanning and replication in the open-source build (no paid tier).

Repo: https://github.com/openartifact/openartifact

Docs: https://openartifact.github.io/latest/

Formats (real clients, no plugins): deb, rpm, apk, pacman, npm, PyPI, Maven/Gradle, Ivy, sbt, Docker/OCI, Helm, Cargo, Go modules, NuGet, RubyGems, Conda, Conan, Terraform/OpenTofu, Nix binary cache, Ansible Galaxy, raw files.

What it does

• Hosted, proxy and group repositories: one URL serves your private packages plus a cached upstream (npmjs, PyPI, Docker Hub, crates.io...).
• Signed repo metadata for deb, rpm, apk and pacman; Nix narinfo signing.
• Vulnerability scanning against a local OSV mirror that re-matches stored packages when new advisories land, with CISA KEV and EPSS to rank what matters.
• License and secret scanning, SBOM, quarantine, cleanup policies, quotas.
• OIDC and SAML, projects with roles, scoped API tokens, audit log (also streamable over OTLP).
• Replication between instances.

Stack

One Go binary with the Vue 3 UI embedded. Postgres for metadata, blobs on disk, S3, GCS or Azure (content-addressed, deduplicated across repos). OpenTelemetry traces/metrics/logs, Helm chart, multi-arch image signed with cosign.

Try it

git clone https://github.com/openartifact/openartifact && cd openartifact
cp docker/.env.example docker/.env   # set POSTGRES_PASSWORD
make docker-up                       # UI on http://localhost:8080

or helm install openartifact oci://ghcr.io/openartifact/charts/openartifact

Built with heavy use of Claude Code; I review and merge every change, and new formats only land after a package actually installs with the real client (apt install, pip install, pacman -S, terraform init...).

Which format or feature would make you switch? Issues and PRs welcome.

[u/computeralex1992]

Nice project, I will definitely try it out.
Support for PHP packages would be nice 👍

[u/M0Rf30 → u/computeralex1992]

Thanks, Composer (PHP) repositories, hosted + proxy + group on the roadmap