JFrog Artifactory

Vetted Packages Through Your Artifactory Instance

ActiveState delivers built-from-source packages as native artifacts directly into your JFrog Artifactory instance. Your teams keep using Artifactory the same way they always have.

Request a Demo

How it works

Configure your Curated Catalog as a remote repository in Artifactory. When developers or CI/CD pipelines pull packages, they resolve from your vetted catalog instead of public registries. No client-side changes, no new tooling.

What ActiveState adds to Artifactory

Packages built from source

Every package in the catalog is compiled in SLSA Level 3 infrastructure. Artifactory stores and distributes them, and ActiveState provides the provenance and security guarantees behind them.

Continuous remediation

When a CVE affects a package in your catalog, ActiveState rebuilds and publishes the patched version. Artifactory serves the update to your teams automatically through your existing promotion workflows.

Full provenance and SBOMs

Every artifact includes build provenance, verified licensing, and a complete SBOM. Artifactory's metadata capabilities surface this information alongside the packages themselves.

FAQs

Do I need a specific Artifactory tier?

ActiveState works with Artifactory Pro, Enterprise, and Cloud editions. Any tier that supports remote repositories can serve as a delivery point for your Curated Catalog.

What package formats does ActiveState deliver through Artifactory?

Native formats for each ecosystem: Python Wheels, Maven JARs, npm tarballs, NuGet packages, and more. Artifactory treats them as standard artifacts.

Secure Your Artifactory Pipeline

Talk to our team about connecting your Curated Catalog to your Artifactory instance.