Smart Remote Repositories

A Smart Remote repository is a remote repository that proxies a local, remote, or Federated repository from another instance of Artifactory or an Edge node. In addition to the usual benefits of Remote Repositories, Smart Remote repositories offer several additional benefits:

Reported Download Statistics

Artifactory maintains download statistics for repositories so you can evaluate if artifacts are still being used and manage your cleanup policies. When you proxy a repository in another instance of Artifactory and cache an artifact downloaded from the other instance, the distant Artifactory is not aware if users on your end continue to use the artifact (by downloading it from your local cache), and may end up cleaning up the original artifact. An Artifactory Smart Remote Repository lets you notify the distant instance whenever a cached artifact is downloaded, so it can update an internal counter for remote downloads.

📘

Download statistics may vary between Artifactory instances

Downloads are reported through the proxy chain only from the time this option is set, so the actual download statistics reported for an artifact may differ between the local Artifactory instance and the remote Artifactory instance.

Synchronized Properties

When you proxy a repository in another instance of Artifactory and cache an artifact downloaded from it, you may not be aware of changes that may have been made to the original artifact’s properties if they are changed after you cache it. By synchronizing properties, any changes to artifact properties in the remote instance are propagated to your cached instance of the artifact.

Remote Repository Browsing

You can browse the contents of the repository in the remote Artifactory instance for all package types, even if none of its artifacts have been cached in your instance of Artifactory. This enables you to browse remote files as if they were local without having to request a particular file.

Source Absence Detection

When viewing a cached artifact, Artifactory will indicate if the original artifact in the remote instance has been deleted. This enables you to copy the artifact from your remote repository cache to a local repository to maintain access to it.

📘

Note

When configuring a Smart Remote Repository, it is generally recommended that a local or remote Artifactory repository be used as an endpoint. A virtual repository is not recommended, as it might result in inconsistent behavior. However, a virtual repository must be used as an endpoint for Go Smart Remote repositories.

Configure a Smart Remote Repository

To create a Smart Remote repository, set the repository URL to point to a repository in another instance of Artifactory. Many package types require you to add the prefix api/<package_type> to the URL.

For example:

http://<JFrog URL>/artifactory/api/<package type>/<repository key>

The prefix is required for the following repository types:

Type

Prefix

AI Editor Extensions

api/aieditorextensions

Ansible

api/ansible

Bower

api/bower

Cargo

api/cargo

Note: The prefix is not required when working in Git mode.

Chef

api/chef

CocoaPods

api/pods

Composer

api/composer

Conan

api/conan

Conda

api/conda

Docker

api/docker

Gems

api/gems

GitLFS

api/lfs

Go

api/go

For more information, see Configure a Go Smart Remote Repository.

Helm

api/helm

Helm OCI

api/oci

HuggingFace

api/huggingfaceml

Machine Learning

api/machinelearning

NIM Model

api/nimmodel

npm

api/npm

NuGet

api/nuget

For more information, see Configure a NuGet Smart Remote Repository.

OCI

api/oci

Pub

api/pub

Puppet

api/puppet

PyPI

When pointing to a local repository: api/pypi

When pointing to a remote repository: no prefix required

For more information, see Create a PyPI Smart Remote Repository.

Swift

api/swift

Terraform

api/terraform

Required for the Registry URL and Providers URL only. For more information, see Create a Terraform Smart Remote Repository.

VCS

api/vcs

All other package types do not require the api/<package_type> prefix.

After you finish entering the URL and move to another field, Artifactory detects automatically that the remote URL is on another instance of Artifactory and displays a banner above the URL.

Smart-Remote-repo-detected_banner.png

The Basic tab of the New Remote Repository screen contains additional fields where you can configure the behavior of your Smart Remote repository.

Smart-Remote-repo_basic-fields.png

Field

Description

Report Statistics

If set, Artifactory will notify the remote instance whenever an artifact in the Smart Remote Repository is downloaded locally so that it can update its download counter.

Note that if this option is not set, there may be a discrepancy between the number of artifacts reported to have been downloaded in the local and remote Artifactory instances.

Sync Properties

If set, properties for artifacts that have been cached in this repository will be updated if they are modified in the artifact hosted at the remote Artifactory instance.

The trigger to synchronize the properties is a download of the artifact from the remote repository cache of the local Artifactory instance.

List Remote Folder Items

If set, enables Remote List Browsing.

Source Absence Detection

If set, Artifactory displays an indication on cached items if they have been deleted from the corresponding repository in the remote Artifactory instance.

📘

Note

Generic repositories do not support this option.

Add User Context for Curation

If enabled, Artifactory will include the user's context in requests sent to the configured remote repository. The user's context will be used by Curation for traceability. This context includes the user's email address as well as repository information, such as the repository ID. Please ensure this is compliant with your regulatory and security requirements.

Relevant for users with JFrog Curation.

Enable Pass-through for Curation Audit

To enable pass-through, first enable Add User Context for Curation. This allows the curation-audit CLI command to download packages from upstream curated remotes. These packages are not cached by the remote repository. Malicious packages are blocked regardless of the pass-through status. For more information, see Enable Pass-Through for Specific Repositories.

Relevant for users with JFrog Curation.

You can modify these settings at any time from the Edit Repository screen.

REST API

For a repository to be identified as a Smart Remote repository, go to the Repository Configuration JSON and under contentSynchronisation set the enabled flag to true.

Create a Go Smart Remote Repository

Go package resolution is supported exclusively through virtual repositories. Therefore, the configuration of a Smart Remote repository for Go differs from other package types.

​​To create a Go Smart Remote repository:​​

  1. On the first Artifactory instance (​​JFROG_INSTANCE_1​​), do the following:
    1. In the ​Administration​ module, go to ​Repositories > Create a Repository > Remote​​.

    2. Choose ​Go​​ as the package type.

    3. In the ​Basic​ tab, verify that the URL is set to the default (https://proxy.golang.org​​).

    4. Enter additional ​basic​ and ​advanced​ settings as required, and then click ​Create Remote Repository​​.

      You now have a virtual repository that points to the official Go registry.

  2. On the first Artifactory instance, create a virtual repository that aggregates the remote repository you just created. For more information, see ​Configure a Virtual Repository.
  3. On the second Artifactory instance, create a Smart Remote repository that points to the virtual repository on the first Artifactory instance. The URL will look like this:
    ​​https://<JFROG_INSTANCE_1>/artifactory/api/go/<JFROG_INSTANCE_1_VIRTUAL_REPO>​​
  4. Enter your username and password for ​​JFROG_INSTANCE_1​​. Alternatively, enter a valid access token issued by ​JFROG_INSTANCE_1​​.
  5. Click the ​​Test​​ button to verify the connection to the first Artifactory instance.
  6. To configure your Go client with the newly created Smart Remote repository, see ​Connect Your Go Client to Artifactory.

Create a NuGet Smart Remote Repository

The procedure for creating a Smart Remote repository for NuGet involves additional configuration, as described below.

To create a NuGet Smart Remote repository:

  1. On the first Artifactory instance (JFROG_INSTANCE_1), do the following:

    1. In the Administration module, go to Repositories > Create a Repository > Remote.
    2. Choose NuGet as the package type.
    3. In the Basic tab, enter the URL of the desired remote NuGet registry (default: https://www.nuget.org).
    4. Enter additional basic and advanced settings as required, and then click Create Remote Repository. You now have a remote repository that points to the remote NuGet registry.
  2. On the second Artifactory instance, create a Smart Remote repository that points to the remote repository on the first Artifactory instance. The URL will look like this:

    https://<JFROG_INSTANCE_1>/artifactory/api/nuget/<JFROG_INSTANCE_1_REMOTE_REPO>

  3. Enter your username and password for JFROG_INSTANCE_1. Alternatively, enter a valid access token issued by JFROG_INSTANCE_1.

  4. In the Basic tab of the second Artifactory instance, configure the following settings:

    • NuGet Download Context Path: Download
    • NuGet Feed Context Path: Leave blank
    • NuGet v3 Feed URL (see note below): https://<JFROG_INSTANCE_1>/artifactory/api/nuget/v3/<JFROG_INSTANCE_1_REMOTE_REPO>/
  5. Click the Test button to verify the connection to JFROG_INSTANCE_1.

  6. To configure your NuGet client with the newly created Smart Remote repository, see Connect Your NuGet Client to Artifactory.

📘

Important

The Feed URL is used to download the index.json/feed.json file, which serves as the service index for NuGet packages. Make sure to point this Feed URL to your Smart Remote repository (JFROG_INSTANCE_1) so that it serves as your service index and feed. Without this, the Smart Remote repository will try to go directly to nuget.org for feed resolution, which will prevent JFROG_INSTANCE_1 from caching artifacts correctly and may be blocked by network restrictions.

Create a PyPI Smart Remote Repository

The procedure for creating a Smart Remote repository for PyPI involves an additional step, as described below.

To create a PyPI Smart Remote repository:

  1. On the first Artifactory instance (JFROG_INSTANCE_1), do the following:

    1. In the Administration module, go to Repositories > Create a Repository > Remote.

    2. Choose PyPI as the package type.

    3. In the Basic tab, enter a repository key. The following default settings for PyPI are predefined:

    4. Enter additional basic and advanced settings as required, and then click Create Remote Repository.

    You now have a remote repository that points to the official PyPI upstream registry.

  2. On the second Artifactory instance, set up a Smart Remote repository that proxies the first repository:

    1. Create a remote PyPI repository, as described above.

    2. Enter a repository key and enter additional settings as required.

    3. Modify the URL and Registry URL fields as follows:

      • URL: https://<JFROG_INSTANCE_1_URL>/artifactory/<REPO_KEY_IN_JFROG_INSTANCE_1>
      • Registry URL: https://<JFROG_INSTANCE_1_URL>/artifactory/api/pypi/<REPO_KEY_IN_JFROG_INSTANCE_1>
📘

Note

<REPO_KEY_IN_JFROG_INSTANCE_1> refers to the name of the PyPI remote repository you created on the first Artifactory instance (<JFROG_INSTANCE_1>) in step 1.

  1. Enter your username and password for JFROG_INSTANCE_1. Alternatively, enter a valid access token issued by JFROG_INSTANCE_1.
  2. Click the Test button to verify the connection to the first Artifactory instance.
  3. To configure your PyPI client with the newly created Smart Remote repository, see Connect Your PyPI Client to Artifactory.

Create a Terraform Smart Remote Repository

The procedure for creating a Smart Remote repository for Terraform involves an additional step, as described below.

​​To create a Terraform Smart Remote repository:​​

  1. On the first Artifactory instance (​​JFROG_INSTANCE_1​​), do the following:

    1. In the Administration module, go to ​Repositories > Create a Repository > Remote​​.

    2. Choose ​Terraform/OpenTofu​​ as the package type.

    3. Configure the repository, as described in ​Remote Terraform Repository​​, and then click ​Create Remote Repository​.

      You now have a remote repository that points to your Terraform upstream registry.

  2. On the second Artifactory instance, set up a Smart Remote repository that proxies the first repository:

    1. Create a remote Terraform repository, as described above.
    2. Enter a repository key and enter additional settings as required.
    3. Modify the URL, Registry URL, and Providers URL fields as follows:
      • URL: https://<JFROG_INSTANCE_1_URL>/artifactory/<REPO_KEY_IN_JFROG_INSTANCE_1>
      • Registry URL: https://<JFROG_INSTANCE_1_URL>/artifactory/api/terraform/<REPO_KEY_IN_JFROG_INSTANCE_1>
      • Providers URL: https://<JFROG_INSTANCE_1_URL>/artifactory/api/terraform/<REPO_KEY_IN_JFROG_INSTANCE_1>/providers
    📘

    Note

    <REPO_KEY_IN_JFROG_INSTANCE_1> refers to the name of the Terraform remote repository you created on the first Artifactory instance (<JFROG_INSTANCE_1>) in step 1.

  3. Enter your username and password for ​JFROG_INSTANCE_1​​. Alternatively, enter a valid access token issued by ​JFROG_INSTANCE_1​​.

  4. Click the ​Test​​ button to verify the connection to the first Artifactory instance.

  5. To configure your Terraform client with the newly created Smart Remote repository, see ​Connect Your Terraform/OpenTofu Client to Artifactory.

Remote List Browsing

When List Remote Folder Items is checked for a repository, Artifactory lets you navigate the contents of the repository at the remote Artifactory instance, for all package types, even if the artifacts have not been cached in the repository defined in your instance of Artifactory. If the remote server discloses its files in a simple HTML index, Artifactory will try to list them.