Artifact Registry

Automated, continuous scanning of every artifact upon push and on a recurring schedule. The registry integrates with public vulnerability databases (CVEs) to flag known risks in operating system packages and language-level dependencies. Key aspects include:

• Layer-by-layer container image analysis
• Identification of high and critical severity CVEs
• Blocking of deployments based on policy violations
• Integration with Vulnerability Exploitability eXchange (VEX) to filter non-exploitable findings

Enforces strict, identity-based permissions for pushing, pulling, and deleting artifacts. Policies are managed as code using engines like Open Policy Agent (OPA). This ensures:

• Role-based access control (RBAC) for teams
• Repository-level isolation for different projects
• Temporary, scoped tokens for CI/CD pipelines
• Integration with Workload Identity for keyless authentication

Ensures artifact integrity and non-repudiation from build to deployment. The registry supports keyless signing via Sigstore and Cosign, which ties signatures to short-lived OIDC certificates. This enables:

• Verification that an artifact has not been tampered with
• Confirmation of the build system's identity
• Enforcement of Binary Authorization policies at deploy time
• Storage of attestations in a Transparency Log for auditing

Artifacts are immutable once published. Any change, no matter how small, generates a new, unique version identified by a content-addressable digest. This prevents:

• Overwriting of production dependencies (dependency confusion)
• Drift between development and production environments
• Unauthorized modification of released software
• Enables precise dependency pinning and reproducible builds

Automatically constructs a dependency graph mapping all transitive relationships between stored components. The registry can generate a Software Bill of Materials (SBOM) in standard formats like SPDX or CycloneDX on demand. This provides:

• Complete visibility into the software supply chain
• Rapid impact analysis when a new zero-day vulnerability is disclosed
• Streamlined license compliance auditing

Acts as a pull-through cache for upstream public registries (e.g., Docker Hub, Maven Central, PyPI). This centralizes egress traffic and insulates builds from external outages. Benefits include:

• Reduced bandwidth consumption and faster builds
• A single point of governance for all external dependencies
• The ability to quarantine and scan third-party libraries before internal use
• Protection against dependency confusion attacks by prioritizing private packages

A supply chain attack vector where a malicious package with a higher version number is uploaded to a public registry, tricking a build system into downloading it instead of the intended private dependency. Mitigations include:

• Scoping private packages with namespaces or scoped registries
• Configuring clients to prioritize the private artifact registry
• Using dependency pinning to exact versions and hashes

The automated process of analyzing container images layer-by-layer to identify embedded OS packages, libraries, and known vulnerabilities before deployment. Registry integration features:

• Continuous scanning on push to the artifact registry
• CVE databases mapped to package manifests
• Policy-based blocking of images exceeding vulnerability thresholds
• Generates VEX statements to reduce false positives