Skip to main content

​
Overview

The GCP Package Registry integration allows Backline to access private packages from your Google Artifact Registry. This is required for Backline to build and analyze projects that depend on private npm, PyPI, or Go packages hosted on Google Cloud.

​
What You Can Do

With the GCP Package Registry integration, Backline can:
  • Resolve packages from your Google Artifact Registry package repositories
  • Build and analyze projects that depend on those packages
  • Provide remediation for vulnerabilities in projects using them as a package source
This integration covers packages at <region>-npm.pkg.dev, <region>-python.pkg.dev, and <region>-go.pkg.dev addresses. It grants Backline no access to your container images. For container images at gcr.io and <region>-docker.pkg.dev addresses, connect GCP Artifact Registry instead. The two are separate connections, each with its own credential, status, and lifecycle, and you can hold both at once.

​
Prerequisites

Before connecting GCP Package Registry, ensure you have:
  • A Google Cloud account with Artifact Registry package repositories
  • The Artifact Registry API enabled for your project
  • Permissions to create service accounts and assign roles

​
Enabling the Artifact Registry API

Enable the Artifact Registry API for the Google account you plan on integrating with Backline.
1

Navigate to the API Library

Go to the Artifact Registry API page in the Google Cloud Console.
2

Select Your Project

Select the Google project for which you want to enable the API.
3

Enable the API

Click Enable.
Allow a few minutes for Google to propagate the enablement before proceeding.

​
Creating a Service Account

To enable permissions for the GCP Package Registry integration, you need to create a service account with the appropriate roles.
1

Navigate to Credentials

Go to the Google Cloud Console Credentials page.Select the Google project for which you are creating credentials if it is not already selected.
2

Create Service Account

Click the Create Credentials button and select Service Account.Give the new service account a unique name and ID, then click Create and Continue.
3

Assign Permissions

On the Service account permissions page:
  1. Click Select a role and choose Artifact Registry Reader
  2. Click Add another role
  3. Add a role that has the resourcemanager.projects.list permission, such as Browser or Viewer
  4. Click Continue, then Done
The Browser role provides minimal permissions while still allowing project listing. Use Viewer if you need broader read access.
4

Generate JSON Key

  1. In the Service Accounts section, click on the service account you just created
  2. Go to the Keys tab
  3. Click Add Key → Create new key
  4. Select JSON as the key type
  5. Click Create
The JSON key file will be downloaded automatically.
Store the JSON key securely. You’ll need it when configuring the integration in Backline. This key provides access to your Artifact Registry.

​
Required Permissions

The service account requires the following roles:
Follow the principle of least privilege by using the Browser role instead of Viewer when possible. Backline only needs to read packages, not modify them.

​
Connecting GCP Package Registry

1

Go to Integration Hub

In Backline, navigate to Integrations from the main menu.
2

Select GCP Package Registry

Find and click on the GCP Package Registry integration card.
3

Upload JSON Key

Upload or paste the contents of the JSON key file you generated earlier.
4

Enter Repository URLs

Provide at least one package repository URL — NPM, PyPI, or Go. Each must be a pkg.dev URL, for example https://us-central1-npm.pkg.dev/your-project/your-repo/.
5

Complete Connection

Click Connect. Backline validates the service account key, authenticates with Google, and then lists packages in each repository URL you provided, so a URL the service account cannot read is reported before the connection is saved.

​
After Connection

Once GCP Package Registry is configured, Backline will:
  1. Use the provided service account to authenticate with Google Artifact Registry
  2. Access packages from your configured repositories during dependency analysis
  3. Provide remediation for projects that depend on those packages

​
Managing the Integration

​
Updating Configuration

To update the integration settings:
  1. Open the Integration Hub
  2. Click on the GCP Package Registry integration
  3. Upload a new JSON key or change the repository URLs if needed
  4. Click Save

​
Rotating Keys

To rotate the service account key:
  1. Generate a new JSON key in the Google Cloud Console (following the steps above)
  2. Update the key in Backline
  3. Delete the old key from the Google Cloud Console
Regularly rotating service account keys is a security best practice.

​
Disconnecting

To remove the GCP Package Registry integration:
  1. Go to the Integration Hub
  2. Click on the GCP Package Registry integration
  3. Select Disconnect
  4. Confirm your choice
Disconnecting will prevent Backline from accessing private packages in your Google Artifact Registry. Dependency analysis and remediation for projects using private packages may be affected.

​
Troubleshooting

​
Authentication Failed

If Backline cannot authenticate with Google Cloud:
  • Verify the JSON key file is valid and not corrupted
  • Check that the service account hasn’t been deleted
  • Ensure the key hasn’t been revoked in the Google Cloud Console

​
Permission Denied

If Backline cannot access repositories:
  • Verify the service account has the Artifact Registry Reader role
  • Check that the Browser or Viewer role is assigned
  • Ensure the Artifact Registry API is enabled for your project

​
Package Resolution Issues

If specific packages cannot be resolved:
  • Verify the package exists in your Google Artifact Registry
  • Check that the service account has access to the correct project
  • Allow a few minutes for the API enablement to propagate