Google

Google Artifact Registry is a single place for your organization to manage container images and language packages (such as Maven and NPM). It fully integrates with Google Cloud's tooling and runtimes and supports native artifact protocols.

By connecting GAR, you will gain the ability to generate SBOM from your artifact, OS vulnerability alerts about your containers, and check the artifact integrity of your containers.

For OX to offer maximum protection, we require a Project ID and API key. This page will help you understand how to provide them to us.

Setting up your user correctly

Go to your cloud workspace, and create a new principal user with the following custom role:

Granting Permissions

We kindly ask that you provide us with the following permissions:

artifactregistry.dockerimages.get
artifactregistry.dockerimages.list
artifactregistry.files.get
artifactregistry.files.list
artifactregistry.locations.get
artifactregistry.locations.list
artifactregistry.mavenartifacts.get
artifactregistry.mavenartifacts.list
artifactregistry.npmpackages.get
artifactregistry.npmpackages.list
artifactregistry.packages.get
artifactregistry.packages.list
artifactregistry.projectsettings.get
artifactregistry.pythonpackages.get
artifactregistry.pythonpackages.list
artifactregistry.repositories.downloadArtifacts
artifactregistry.repositories.get
artifactregistry.repositories.list
artifactregistry.repositories.listEffectiveTags
artifactregistry.repositories.listTagBindings
artifactregistry.tags.get
artifactregistry.tags.list
artifactregistry.versions.get
artifactregistry.versions.list
resourcemanager.projects.get
storage.buckets.get
storage.multipartUploads.list
storage.objects.get
storage.objects.list

Setting up Project ID and API Token

After choosing the repositories (inside your organization) that you would like to scan, copy their ID and paste it into OX.

Once you have the API token, encode it to base64 and paste the result into the API token field in the OX platform. You can do so by following these steps:

• Save the API token as a JSON file.

• In your CMD, type the following command:

base64 -w 0 <your file> > mykey

• Paste the result into the API token field in OX