JFrog compatibility

Relic serves the APIs of JFrog® Artifactory® and Xray®. The JFrog CLI (jf), the package managers it configures, and code written for those APIs work against Relic unchanged. To move an Artifactory into Relic, see Migrating from Artifactory.

Configure jf

Create an access token in the UI, under Set me up. Add Relic to jf as a server:

jf config add relic --url https://relic.example.com --user <you> --access-token <token> --interactive=false

Check that jf reaches Relic:

jf rt ping --server-id relic

jf login also works: approve the code jf shows in the UI. LDAP users sign in the same ways.

If Relic's certificate comes from a private CA, such as the one Relic generates (TLS), add the CA certificate to the system trust store of the machine that runs jf.

Endpoints jf uses

Clients configured by jf use paths under /artifactory/, such as /artifactory/api/npm/<repo>/. Clients configured by relic package setup use Relic's own paths, such as /npm/<repo>/. Both reach the same repositories. A Git LFS repository's API is at /artifactory/api/lfs/<repo> as well as /lfs/<repo>.

Package managers

Configure npm, yarn and pnpm:

jf npmc --server-id-resolve relic --repo-resolve npm --server-id-deploy relic --repo-deploy npm-local

Then jf npm install and jf npm publish work.

Configure Maven:

jf mvnc --server-id-resolve relic --repo-resolve-releases maven --repo-resolve-snapshots maven \
  --server-id-deploy relic --repo-deploy-releases maven-local --repo-deploy-snapshots maven-local

Then jf mvn deploy works. Gradle works the same way with jf gradlec and jf gradle.

Configure Go:

jf goc --server-id-resolve relic --repo-resolve go --server-id-deploy relic --repo-deploy go-local

Then jf go build ./... builds and jf go-publish v1.2.3 publishes a module version.

Configure pip:

jf pipc --server-id-resolve relic --repo-resolve pypi

Then jf pip install requests works.

Configure Poetry with a repository that is not named pypi, such as pypi-remote. jf names the Poetry source after the repository, and Poetry refuses a source named pypi with The PyPI repository cannot be configured with a custom url.

jf poetry-config --server-id-resolve relic --repo-resolve pypi-remote

Then jf poetry install works.

Push a Docker image and record build info:

jf docker push relic.example.com/docker-local/app:1.0 --build-name app --build-number 1

Configure NuGet:

jf dotnetc --server-id-resolve relic --repo-resolve nuget

Then jf dotnet restore works.

Configure Terraform:

jf tfc --server-id-deploy relic --repo-deploy terraform-local

Publish each module under the current directory:

jf tf publish --namespace acme --provider aws --tag v1.0.0

Upload a Hugging Face model:

jf hf upload <folder> <org>/<model> --repo-key hf

jf hf download downloads one; both work through Xet.

Upload generic files:

jf rt upload "build/*" generic-local/app/

jf rt download, set-props, search, copy, move and delete work on the same patterns.

Configuration

jf rt repo-create, jf rt permission-target-create and jf rt replication-create create repositories, permission targets and replications in Relic.

Relic also serves:

Restore an item from the trash can (/api/trash/empty empties it):

jf rt curl -XPOST "/api/trash/restore/libs-local/org/app/1.0/app-1.0.jar"

Builds

The package-manager commands record build info with --build-name and --build-number. Publish it:

jf rt build-publish app 1

The other jf rt build-* commands and docker-promote also work. Builds published with --project appear under Builds in the UI once you pick the project.

Scanning

• jf audit scans on the client from the dependency tree. jf scan and jf docker scan scan on the client with the relic-indexer builds Relic serves (RELIC_INDEXER_DIR). The Docker image includes them; on a single-binary installation the install script adds them.
• When no worker with Syft and Grype has reported in the last 20 minutes, jf audit, jf scan, jf docker scan and jf build-scan fail at once with 424 Failed Dependency. So do the requests behind them, including polling a queued scan and asking to scan an artifact. Stored results stay readable. On a new installation with a separate worker, this also applies until the worker has started for the first time.
• The same commands fail when the worker has no vulnerability database and none is coming: downloads are off and none was imported, or its download failed. They wait while a download is running. Stored artifacts report a failed scan and are scanned again when a database arrives.
• jf build-scan scans a published build. Build scans and jf audit report vulnerabilities only; license policies apply to stored artifacts.
• jf scan --licenses lists the licenses relic-indexer finds. jf audit --licenses lists each dependency as Unknown.
• jf curation-audit reports every package as approved: Relic has no curation policies. When a Relic Scan watch blocks a package the package manager needs, the audit stops with HTTP 403.
• jf evd needs a server configured with --access-token.

Limits

• --archive-entries is not supported: Relic does not index files inside archives and answers with 400. The Archive tab of an artifact in the UI lists them.
• Relic signs every release bundle with its own key pair, release-bundles. jf rbc, jf rbf and jf rbp with --signing-key naming another key answer 400; leave the flag out.
• jf rbp --promotion-type move copies: the artifacts stay in the previous environment's repositories. jf reports success, and the promotion record says the move was performed as a copy.

REST APIs

They accept Basic credentials or an access token, and JFrog's documentation describes them. The API reference covers the Relic API only. The UI's session cookie works under /api/ only, so a browser page cannot call these APIs.

Run an AQL search:

curl -u <user>:<token> -X POST https://relic.example.com/artifactory/api/search/aql \
  -d 'items.find({"repo":"libs-local","name":{"$match":"*.jar"}})'

JFrog Go SDK

Code written with jfrog-client-go works against Relic. Point the service details at /artifactory/; the password can be an access token:

details := auth.NewArtifactoryDetails()
details.SetUrl("https://relic.example.com/artifactory/")
details.SetUser("ci")
details.SetPassword(os.Getenv("RELIC_TOKEN"))

Relic is tested with jfrog-client-go v1.55.0.

Not provided

AppTrust, Distribution v1, Mission Control, Pipelines and Workers routes answer 404 with "Relic does not provide" and the product's name, so jf fails at once. jf release-bundle-distribute gets 404 with "Relic does not distribute release bundles". jf rt transfer-* fails; use relic import artifactory instead.