Have a question? Want to report an issue? Contact JFrog support

Skip to end of metadata
Go to start of metadata


From version 5.11.0, Artifactory offers fully featured support for Go packages and provides:

  1. Secure, private Go registries with fine-grained access control over Go packages according to projects or development teams.
  2. Remote Go registries which provide proxy and caching functionality for remote Go resources.
  3. Enterprise features such as high availability, repository replication for multi-site development and different options for massively scalability storage.
  4. A full solution with JFrog CLI, allowing you to resolve and publish your Go projects.

Installing Go and Vgo

Artifactory requires Go version 1.10.1 or higher.

To use Go with Artifactory, you need to install both the Go client and vgo. 

To learn more about vgo please visit the vgo GitHub repository.

vgo has not been officially released

Since vgo has not been officially released yet, it may be subject to modifications which may change how you use it with Artifactory. 

Page Contents



To install the Go client, please refer to the  The Go Programming Language documentation.

Using Homebrew?

If you are using Homebrew you can also install the Go client by running:

brew install go

Once you have installed the Go client, you can then install vgo by running:

go get -u golang.org/x/vgo


Local Repositories

To deploy Go packages to a local Go registry and enable calculation of Go package metadata, set Go to be the Package Type when you create your local repository.

Local Go Repository

Remote Repositories

Since most of the packages are hosted in GitHub, you will want to create a Remote Repository which serves as a caching proxy for github.com

Artifacts (such as zip files) requested from a remote Go registry are cached on demand. You can remove downloaded artifacts from the remote repository cache, however you can not manually deploy artifacts to a remote repository. 

To define a remote repository to proxy github.com, follow the steps below:

  1. Create a new remote repository and set Go to be its Package Type
  2. Set the Repository Key value, and enter https://github.com in the URL field as displayed below
  3. Click "Save & Finish"

Go Remote Repository

Virtual Repositories

A Virtual Repository defined in Artifactory aggregates packages from both local and remote repositories.
This allows you to access both locally hosted Go packages and packages from remote proxied Go registries from a single URL defined for the virtual repository.

To create a virtual repository as a Go registry set Go to be its Package Type, and select the underlying local and remote repositories to include under the Repositories section.

Advanced Configuration

To allow Artifactory to access the metadata that contains the  Remote Import Paths that describe where on GitHub to obtain the source code of the Go packages in your virtual repositories, the Enable Dependency Rewrite checkbox should be set (this is the default).

Enable Dependency Rewrite
When checked, automatically rewriting external dependencies is enabled.
Patterns Whitelist

A white list of Ant-style path expressions that specify where external metadata containing Remote Import Paths may be downloaded from. By default, this is set to ** which means that metadata may be downloaded from any external source.

For example, if you wish to limit external metadata to only be downloaded from github.com, you should add **/github.com/** (and remove the default ** expression).


Using Go with Artifactory

Much of your work with Go and Artifactory is done through JFrog CLI, a thin client that wraps the vgo client. To learn more, please refer to the JFrog CLI User Guide.

Did you know?

 JFrog CLI is, itself, written in Go

Resolving Go Projects

go.mod is a metadata file that describes a Go package. It contains the package's module name and a list of its dependencies.

To allow successful resolution of a package, the vgo client requires its corresponding go.mod file to be found in the same folder.

For example, in this "Hello Worlds" Go project, the go.mod file specifies a module github.com/you/hello, with a single dependency, rsc.io/quote v1.5.2.

module github.com/you/hello
require rsc.io/quote v1.5.2

Resolving Transitive Dependencies Locally

To fully resolve a Go project, each transitive dependency needs to have its corresponding go.mod file in place in the same folder where it resides. However, in many cases, the go.mod file does not exist. To resolve a Go project in this case, follow these steps:

  1. Manually download all required dependencies from the internet to your local machine
  2. Run your build while resolving dependencies locally
  3. Publish your built package to Artifactory as described below.

From this point on, you can rebuild your project while resolving dependencies from Artifactory   

Building Go Packages

To build your Go projects, use JFrog CLI. JFrog CLI downloads the dependencies needed for the project from the internet and creates the corresponding go.mod file. When you later use JFrog CLI to publish your package to Artifactory, the go.mod file is uploaded alongside the package to Artifactory.

For details, please refer to the JFrog CLI documentation

Publishing Go Projects

The Go client works through a Git repository which hosts the Go package source code, and does not provide a way to directly publish packages to Artifactory.

To publish your package to Artifactory, use JFrog CLI as described in the JFrog CLI documentation.

  • No labels