A virtual repository is a type of Artifact Registry repository that lets you access
Assured Open Source Software (Assured OSS) packages from multiple upstream repositories
through a single repository.

Virtual repositories are supported in the free tier only. In the premium tier,
Assured OSS repositories are provisioned automatically.

For more information about
repository options, see [Assured OSS repository
options](https://docs.cloud.google.com/assured-open-source-software/docs/overview#aoss-repository-options).

## Before you begin

If you want to use a virtual repository to access the Assured OSS packages, do
the following:

- Provide the
  [Artifact Registry Service Agent](https://docs.cloud.google.com/artifact-registry/docs/ar-service-account)
  details for the project you want to use in the Assured OSS [Customer
  Enablement form](https://developers.google.com/assured-oss#get-started). The Artifact Registry Service Agent is a Google-managed
  service account that acts on behalf of Artifact Registry when interacting
  with Google Cloud services. Virtual repositories use the service to
  authenticate to upstream repositories. The service agent requires read
  access to the Assured OSS Artifact Registry repository.

- You can enable the service agent access during your initial enrollment
  by including the service agent details as one of the service accounts you
  want to have access to Assured OSS.

- If you have already enabled Assured OSS access without
  including the service agent details, return to the Assured OSS
  enablement website and create a new enablement request for the service
  agent with its specific details.

- For instructions to find the name of the existing service agent or
  create a new service agent for your project, see
  [Artifact Registry service account](https://docs.cloud.google.com/artifact-registry/docs/ar-service-account).

## Set up a virtual repository

1. [Create a virtual repository](https://docs.cloud.google.com/artifact-registry/docs/repositories/virtual-repo#create)
   in the same Google Cloud region where the Assured OSS
   Artifact Registry repository resides. Use the project whose service agent has read
   access to the Assured OSS Artifact Registry repository.

2. In the `policies.json` file, add the following configuration to give the
   virtual repository access to the Assured OSS Artifact Registry
   repository:

   - Configuration for the Java repository:

       {
         "id" : "AOSS Java",
         "repository" : "projects/cloud-aoss/locations/us/repositories/cloud-aoss-java",
         "priority" : 100
       }

   - Configuration for the Python repository:

       {
         "id" : "AOSS Python",
         "repository" : "projects/cloud-aoss/locations/us/repositories/cloud-aoss-python",
         "priority" : 100
       }

   - Configuration for the Go repository:

       {
         "id" : "AOSS Go",
         "repository" : "projects/cloud-aoss/locations/us/repositories/assuredoss-go-free",
         "priority" : 100
       }

3. Download the Java, Python, and Go packages using the virtual repository. For
   instructions on downloading the packages, see the following topics:

   - [Download Java packages](https://docs.cloud.google.com/assured-open-source-software/docs/download-java-packages)
   - [Download Python packages](https://docs.cloud.google.com/assured-open-source-software/docs/download-python-packages)
   - [Download Go packages](https://docs.cloud.google.com/assured-open-source-software/docs/download-go-packages)

## Access packages not available in Assured OSS

If you want access to packages that aren't available in the Artifact Registry
repository for Assured OSS, you can do the following:

- Assured OSS is also pre-configured with
  Assured OSS as the preferred repository and canonical public
  repositories, such as Maven Central or PyPI, as secondary repositories. To use
  this feature ([Preview](https://cloud.google.com/products#product-launch-stages)), you can point to a
  single URL:

  - For Java, use `https://us-maven.pkg.dev/cloud-aoss/java`
  - For Python, use `https://us-python.pkg.dev/cloud-aoss/python`
  - For Go, use `https://us-go.pkg.dev/cloud-aoss/go`

## What's next

- [Supported Java and Python packages](https://docs.cloud.google.com/assured-open-source-software/docs/supported-packages)
- [Supported Go packages](https://docs.cloud.google.com/assured-open-source-software/docs/supported-packages-go)
- [Access security metadata using Artifact Analysis API](https://docs.cloud.google.com/assured-open-source-software/docs/access-metadata-using-container-analysis)
- [Access security metadata using Cloud Storage](https://docs.cloud.google.com/assured-open-source-software/docs/access-metadata-using-cloud-storage)
- [Subscribe to notifications](https://docs.cloud.google.com/assured-open-source-software/docs/use-notifications)
- [Artifact signature overview](https://docs.cloud.google.com/assured-open-source-software/docs/package-signature-overview)