Supported package functionality

The GitLab package registry supports different functionalities for each package type. This support includes publishing and pulling packages, request forwarding, managing duplicates, and authentication.

Publishing packages

Packages can be published to your project, group, or instance.

Pulling packages

Packages can be pulled from your project, group, or instance.

Forwarding requests

When a package is not found in your project’s package registry, GitLab can forward the request to the corresponding public registry. For example, Maven Central, npmjs, or PyPI.

The default forwarding behavior varies by package type and can introduce a dependency confusion vulnerability.

To reduce the associated security risks:

• Verify the package is not being actively used.
• Disable request forwarding:
  • Instance administrators can disable forwarding in the Continuous Integration section of the Admin area.
  • Group owners can disable forwarding in the Packages and Registries section of the group settings.
• Implement a version control tool, like Git, to track changes to packages.

Deleting packages

When package requests are forwarded to a public registry, deleting packages can be a dependency confusion vulnerability.

If a system tries to pull a deleted package, the request is forwarded to the public registry. If a package with the same name and version is found in the public registry, that package is pulled instead. There is a risk that the package pulled from the registry might not be what is expected, and could even be malicious.

To reduce the associated security risks, before deleting a package you can:

• Verify the package is not being actively used.
• Disable request forwarding:
  • Instance administrators can disable forwarding in the Continuous Integration section of the Admin area.
  • Group owners can disable forwarding in the Packages and Registries section of the group settings.

Importing packages from other repositories

You can use GitLab pipelines to import packages from other repositories, such as Maven Central or Artifactory with the package importer tool.

Allow or prevent duplicates

By default, the GitLab package registry either allows or prevents duplicates based on the default of that specific package manager format.

Authentication tokens

GitLab tokens are used to authenticate with the GitLab package registry.

The following tokens are supported:

Authentication protocols

The following authentication protocols are supported:

1. Basic authentication for Maven packages introduced in GitLab 16.0.

Supported hash types

Hash values are used to ensure you are using the correct package. You can view these values in the user interface or with the API.

The package registry supports the following hash types: