> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/integrations/artifactory.md). # Artifactory integrations Configure JFrog Artifactory to sit between your CI pipeline and the Seal Artifact Server, so builds pull sealed packages through your existing infrastructure. When the only path from your CI pipeline to the public internet runs through your organization's JFrog Artifactory, you can configure Artifactory as a proxy in front of the Seal Artifact Server. Your build authenticates against Artifactory, and Artifactory authenticates against Seal on its behalf. Two scenarios are covered: * **Artifact Server deployment method.** The Seal CLI is not in the pipeline. Sealed versions are pinned in your manifests, and each ecosystem's package manager pulls from a JFrog remote that points at the Seal Artifact Server. * **CLI-driven deployment methods (Remote, Local, or Automatic Remediation).** The Seal CLI runs in the pipeline. With JFrog enabled in the CLI's configuration, the CLI routes both its Seal-Platform backend calls and its sealed-package fetches through JFrog remotes. This path covers Java projects. The two scenarios share the per-ecosystem JFrog remote configuration. The CLI scenario adds one additional JFrog remote (for the CLI's backend), a JFrog access token, and a small set of environment variables on the CLI. ## Per-ecosystem JFrog remotes For each ecosystem you seal (npm, Maven, etc.), create a remote in JFrog pointing at Seal's ecosystem endpoint. The per-ecosystem URLs and JFrog repository types follow the same pattern as configuring any other Seal Artifact Server remote. See [Configuring package managers](/setup-apps-os/artifact-server/configuring-package-managers.md) for the per-ecosystem reference; in JFrog these become the corresponding remote-repository configurations. Authenticate each remote with a Seal artifact-server token. Generate one in the Seal UI; see [Generating tokens](/getting-started/tokens/generating-tokens.md). In the Artifact Server deployment, this is the whole setup: configure your package managers to pull from the JFrog remotes and the build does the rest. Every ecosystem Seal supports is available this way. The CLI passthrough below is narrower, and the remote it reads for sealed packages is configured differently. If the CLI runs in your pipeline, follow that section rather than this one. ## JFrog passthrough for the Seal CLI When the Seal CLI runs in the pipeline, the CLI needs to reach two Seal endpoints: the Seal Platform's CLI backend, and the Seal Artifact Server. With JFrog enabled, both go through JFrog, and each one needs its own remote in Artifactory. Sealed-package downloads through Artifactory cover Java: Maven, Gradle, and Java files. Pointing the CLI at another ecosystem with JFrog enabled fails at startup with an unsupported-ecosystem error; it does not fall back to downloading from Seal directly. For those ecosystems, either leave JFrog disabled on the CLI or use the Artifact Server deployment described above. `seal image fix` is the exception: it reads the CLI-backend remote and never the artifact remote, so it works under JFrog whatever is inside the image. ### Create the CLI-backend remote in JFrog In addition to the per-ecosystem remotes above: * Create a new **Generic** remote repository. * **Repository Key:** `seal-cli`. * **URL:** `https://cli.sealsecurity.io/authenticated/jfrog`. * **User Name:** `jfrog`. * **Password / Access Token:** the Seal artifact-server token. * Enable **Propagate Query Parameters**. * Enable **Disable URL Normalization**. * Disable **Store Artifacts Locally**. ### Create the Maven remote in JFrog This is the remote the CLI downloads sealed packages from. It is a Maven remote pointing at Seal's Maven host: * Create a new **Maven** remote repository. * **Repository Key:** `seal-mvn`. * **URL:** `https://maven.sealsecurity.io/`, with no Project ID in the path. * **Password / Access Token:** the Seal artifact-server token. The CLI requests `https:///artifactory/seal-mvn//-/`, supplying the Project ID and the `/-/` separator itself. That is why the remote's URL stops at the host: the Project ID arrives per request rather than being fixed on the remote. [Project ID attribution](/setup-apps-os/artifact-server/jfrog-artifactory.md#project-id-attribution) covers how Seal reads that prefix. If your Artifactory naming conventions require different repository keys, set `jfrog.cli-repo` and `jfrog.maven-repo` to match. ### Generate a JFrog access token The Seal CLI authenticates against JFrog with a JFrog token, not the Seal token. In JFrog, generate a new access token: * **Token scope:** User. * **User name:** your user. * **Expiration:** Never. * Enable **Create Reference Token**. * Click **Generate** and copy the reference token. ### Configure the CLI Two equivalent paths. **Environment variables:** ```bash SEAL_JFROG_AUTH_TOKEN= SEAL_JFROG_INSTANCE_HOST= SEAL_JFROG_ENABLED=true SEAL_PROJECT= ``` **`.seal-config.yml`:** ```yaml jfrog: host: token: enabled: true project: ``` Do not include a scheme prefix (no `https://`) on the JFrog host value. The CLI validates the host and will reject a malformed value at startup. Connections to Artifactory are made over HTTPS. The build does not need a Seal token. The CLI authenticates to Artifactory with the JFrog reference token, and the Seal token lives on the Artifactory remotes instead. `SEAL_PROJECT` is still required: it is what attributes the run to a Seal Project, both in the artifact path above and on the Protection page. Discovery and remediation work as they do without JFrog. The CLI reports what it found and reads remote Sealing Rules through the CLI-backend remote, so the Protection page and the Sealing rules tab behave normally. ## Related * [Seal Apps via the Seal Artifact Server](/setup-apps-os/artifact-server.md): the no-CLI deployment scenario. * [Seal Apps via the Seal CLI in CI/CD](/setup-apps-os/cli-in-cicd.md): the CLI scenario. * [Configuring package managers](/setup-apps-os/artifact-server/configuring-package-managers.md): per-ecosystem remote URLs. * [JFrog Artifactory as your remote](/setup-apps-os/artifact-server/jfrog-artifactory.md) * [Environment variables](/reference/cli/environment-variables.md#jfrog-artifactory): the full `jfrog` settings table, including the Xray ignore-rule settings.