⌘K

Registry authentication

Use adversary login for the free public catalog. Auth attributes usage; it is not a paywall.

Catalog search and pull go through the Adversary CLI. Sign in with adversary login so we can attribute usage. There is no premium catalog tier. Some listings may remain experimental and need an access grant.

Private packages can live in your hosted team namespace and use this same login flow. Choose a team during browser login with --team. External OCI registries remain supported with their own credentials.

Interactive login

bash

adversary login
adversary whoami
adversary pull go/security
adversary run go/security --path .

Credentials are stored in the selected CLI profile (default default). Use adversary logout to clear them.

Headless and CI

bash

adversary login --device
adversary login --ci

Prefer short-lived --ci tokens or team service accounts for automation rather than long-lived personal credentials.

Service account tokens

Team owners and admins can create automation tokens from the Team page for CI catalog pulls and official publish workflows. Pipe the token into the CLI:

bash

export ADVERSARY_TOKEN="adv_sa_..."

printf '%s\n' "$ADVERSARY_TOKEN" | adversary login \
  --token-stdin --registry-namespace adversarylabs

adversary whoami
adversary pull go/security

api:readregistry:pullregistry:push

Related: CLI, Distribution.