Running an In-house Go Registry with Artifactory

goproxy with Artifactory Go registries

The need for a Go registry

Since its inception over eight years ago at Google, Go has emerged as one of the most popular languages used by developers and DevOps today, so much so that it was used to design and write both Helm and Kubernetes. The project’s 2017 survey of over 6,000 respondents showed that 67% of developers program with Go at work. Most of them rank their expertise in Go higher than their expertise in Javascript, Python, Java, C, Bash or C++, and they also prefer programming in Go compared to any other language. But for all this popularity and usage, facilities to work with Go packages lagged behind.

What was missing in the Go ecosystem was standardization – there wasn’t a standard tool for dependency management, and there wasn’t a standard package format or compatible registry specification. This meant that developers could not create reproducible builds with Go which was quite an issue. Over the years, tools such as dep, godep, glide and govendor entered the scene to handle Go dependency management, but none of these offered an acceptable solution for managing immutable Go packages in an internal Go registry or for setting up a go proxy for remote Go packages. The good news is that Google eventually stepped in and solved the issue once and for all by adding versioning support for Go with vgo.

Vgo is the proposed official standard dependency management tool and registry specification for Go. While not yet included in the official Go tools set, it is poised to be the standard dependency manager distributed with each Go release.

Artifactory Go Registries and go proxy

The recent release of Artifactory 5.11 added support for vgo-compatible Go registries (and go proxy)  giving the community a variety of capabilities when developing with Go. Here are just a few of them:

  • Local repositories in Artifactory let you set up secure, private Go registries with fine-grained access control to packages according to projects or development teams.
  • A remote repository in Artifactory is a caching proxy for remote Go resources such as a GitHub project. Accessing a go proxy through Artifactory removes your dependency on the network, or on GitHub since all dependencies needed for your Go builds are cached in Artifactory and are therefore locally available. This also removes the risk of someone mutating or removing a dependency from version control, or worse, force-pushing changes to a remote Git tag thus changing what should be an immutable version which can create a lot of confusion and instability for dependant projects.
  • A virtual repository aggregates both local and remote Go registries giving you access to all Go resources needed for your builds from a single URL, hiding the complexity of using a combination of both local and remote resources.
  • Enterprise-grade features
    • Multiple layers of security to manage authentication, access control and data privacy
    • Support for massive scalability, both in terms of number of users and volume of Go packages being stored
    • High-availability for extremely robust installations
    • Support for any multi-site topology through a variety of repository replication capabilities

Building Go projects with JFrog CLI and Vgo

JFrog’s solution for Go fills in a few gaps that currently exist in the vgo CLI. JFrog CLI wraps vgo and adds additional capabilities with simple commands like:

jfrog rt go build


jfrog rt go-publish

You can build your Go projects while resolving dependencies through Artifactory, and then publish the resulting Go packages into a secure, private Go registry (i.e., a local Go repository) in Artifactory.

Did you know?
Here at JFrog we are great believers in Go and both JFrog CLI and JFrog Xray are written in Go.

As Go and vgo evolve, so will Artifactory

As vgo continues to evolve, so will JFrog Artifactory and JFrog CLI, maintaining a high level of support for the Go development community.

Get Going with Go and Artifactory. Start your 30-day Free Trial.