Supported package functionality

The GitLab Package Registry supports different functionalities for each package type. This support includes publishing and pulling packages, request forwarding, managing duplicates, and authentication.

Publishing packages

Packages can be published to your project, group, or instance.

Package typeProjectGroupInstance
MavenYNN
npmYNN
NuGetYNN
PyPIYNN
Generic packagesYNN
TerraformYNN
ComposerNYN
ConanYNN
HelmYNN
DebianYNN
GoYNY
Ruby gemsYNN

Pulling packages

Packages can be pulled from your project, group, or instance.

Package typeProjectGroupInstance
MavenYYY
npmYYY
NuGetYYN
PyPIYYN
Generic packagesYNN
TerraformNYN
ComposerYYN
ConanYNY
HelmYNN
DebianYNN
GoYNY
Ruby gemsYNN

Forwarding requests

Requests for packages not found in your GitLab project are forwarded to the public registry. For example, Maven Central, npmjs, or PyPI.

Package typeSupports request forwarding
MavenY
npmY
NuGetN
PyPIY
Generic packagesN
TerraformN
ComposerN
ConanN
HelmN
DebianN
GoN
Ruby gemsN

Allow or prevent duplicates

By default, the GitLab package registry either allows or prevents duplicates based on the default of that specific package manager format.

Package typeDuplicates allowed?
MavenY (configurable)
npmN
NuGetY
PyPIN
Generic packagesY (configurable)
TerraformN
ComposerN
ConanN
HelmY
DebianY
GoN
Ruby gemsY

Authentication tokens

GitLab tokens are used to authenticate with the GitLab Package Registry.

The following tokens are supported:

Package typeSupported tokens
MavenPersonal access, job tokens, deploy (project or group), project access
npmPersonal access, job tokens, deploy (project or group), project access
NuGetPersonal access, job tokens, deploy (project or group), project access
PyPIPersonal access, job tokens, deploy (project or group), project access
Generic packagesPersonal access, job tokens, deploy (project or group), project access
TerraformPersonal access, job tokens, deploy (project or group), project access
ComposerPersonal access, job tokens, deploy (project or group), project access
ConanPersonal access, job tokens, project access
HelmPersonal access, job tokens, deploy (project or group)
DebianPersonal access, job tokens, deploy (project or group)
GoPersonal access, job tokens, project access
Ruby gemsPersonal access, job tokens, deploy (project or group)

Authentication protocols

The following authentication protocols are supported:

Package typeSupported auth protocols
MavenHeaders
npmOAuth
NuGetBasic auth
PyPIBasic auth
Generic packagesBasic auth
TerraformToken
ComposerOAuth
ConanOAuth, Basic auth
HelmBasic auth
DebianBasic auth
GoBasic auth
Ruby gemsToken

Supported hash types

Hash values are used to ensure you are using the correct package. You can view these values in the user interface or with the API.

The Package Registry supports the following hash types:

Package typeSupported hashes
MavenMD5, SHA1
npmSHA1
NuGetnot applicable
PyPIMD5, SHA256
Generic packagesSHA256
Composernot applicable
ConanMD5, SHA1
Helmnot applicable
DebianMD5, SHA1, SHA256
GoMD5, SHA1, SHA256
Ruby gemsMD5, SHA1, SHA256 (gemspec only)