Configuring package managers

Point each ecosystem's package manager at the Seal Artifact Server.

Seal serves packages from one host per ecosystem. Each host is public and shared across all Seal customers; the credentials in your package manager configuration are what identify your tenant and your Seal Project. Authentication is HTTP Basic: the Project ID as the username, the production token as the password.

Ecosystem	Host	Page
npm	https://npm.sealsecurity.io/	Configuring npm
Yarn	https://npm.sealsecurity.io/	Configuring Yarn
pnpm	https://npm.sealsecurity.io/	Configuring pnpm
Maven	https://maven.sealsecurity.io/	Configuring Maven
Gradle	https://maven.sealsecurity.io/	Configuring Gradle
Go modules	https://go.sealsecurity.io/	Configuring Go
pip	https://pypi.sealsecurity.io/simple/	Configuring pip
Poetry	https://pypi.sealsecurity.io/simple/	Configuring Poetry
Bundler	https://ruby.sealsecurity.io/	Configuring Bundler
NuGet	https://nuget.sealsecurity.io/	Configuring NuGet
Composer	https://packagist.sealsecurity.io/	Configuring Composer

The OS-level ecosystems (rpm.sealsecurity.io, deb.sealsecurity.io, apk.sealsecurity.io) are documented under Seal OS in CI/CD.

Multiple remotes and ordering

Most teams run the Seal Artifact Server alongside one or more other remotes (a private registry for internal packages, sometimes the public registry directly). The order matters because it affects whether Seal sees all pulls or only the sealed ones. See Artifact server mode for the two configurations and what each one shows in Seal's view.

Related

• Editing dependency files manually: pinning sealed versions in the manifest, with direct and transitive override mechanisms.

• JFrog Artifactory as your remote: integrating Seal as a remote inside an existing JFrog tenant.