Artifactory integrations
Configure JFrog Artifactory to sit between your CI pipeline and the Seal Artifact Server, so builds pull sealed packages through your existing infrastructure.
Last updated
Configure JFrog Artifactory to sit between your CI pipeline and the Seal Artifact Server, so builds pull sealed packages through your existing infrastructure.
When the only path from your CI pipeline to the public internet runs through your organization's JFrog Artifactory, you can configure Artifactory as a proxy in front of the Seal Artifact Server. Your build authenticates against Artifactory, and Artifactory authenticates against Seal on its behalf.
Two scenarios are covered:
Artifact Server deployment method. The Seal CLI is not in the pipeline. Sealed versions are pinned in your manifests, and each ecosystem's package manager pulls from a JFrog remote that points at the Seal Artifact Server.
CLI-driven deployment methods (Remote, Local, or Automatic Remediation). The Seal CLI runs in the pipeline. With JFrog enabled in the CLI's configuration, the CLI routes both its Seal-Platform backend calls and its sealed-package fetches through JFrog remotes.
The two scenarios share the per-ecosystem JFrog remote configuration. The CLI scenario adds one additional JFrog remote (for the CLI's backend), a JFrog access token, and a small set of environment variables on the CLI.
For each ecosystem you seal (npm, Maven, etc.), create a remote in JFrog pointing at Seal's ecosystem endpoint. The per-ecosystem URLs and JFrog repository types follow the same pattern as configuring any other Seal Artifact Server remote. See Configuring package managers for the per-ecosystem reference; in JFrog these become the corresponding remote-repository configurations.
Authenticate each remote with a Seal artifact-server token. Generate one in the Seal UI; see Generating tokens.
In the Artifact Server deployment, this is the whole setup: configure your package managers to pull from the JFrog remotes and the build does the rest.
When the Seal CLI runs in the pipeline, the CLI needs to reach two Seal endpoints: the Seal Platform's CLI backend, and the Seal Artifact Server. With JFrog enabled, both go through JFrog.
In addition to the per-ecosystem remotes above:
Create a new Generic remote repository.
Repository Key: seal-cli.
URL: https://cli.sealsecurity.io/authenticated/jfrog.
User Name: jfrog.
Password / Access Token: the Seal artifact-server token.
Enable Propagate Query Parameters.
Enable Disable URL Normalization.
Disable Store Artifacts Locally.
The Seal CLI authenticates against JFrog with a JFrog token, not the Seal token.
In JFrog, generate a new access token:
Token scope: User.
User name: your user.
Expiration: Never.
Enable Create Reference Token.
Click Generate and copy the reference token.
Two equivalent paths.
Environment variables:
.seal-config.yml:
Do not include a scheme prefix (no https://) on the JFrog host value. The CLI validates the host and will reject a malformed value at startup.
Seal Apps via the Seal Artifact Server: the no-CLI deployment scenario.
Seal Apps via the Seal CLI in CI/CD: the CLI scenario.
Configuring package managers: per-ecosystem remote URLs.
Last updated
SEAL_JFROG_AUTH_TOKEN=<jfrog reference token>
SEAL_JFROG_INSTANCE_HOST=<your jfrog host, for example domain.jfrog.io>
SEAL_JFROG_ENABLED=true
SEAL_PROJECT=<seal project id>jfrog:
host: <your jfrog host, for example domain.jfrog.io>
token: <jfrog reference token>
enabled: true
project: <seal project id>