SKAO Binary Artefacts Repository (BAR)

Note

BAR v1 and v2 APIs are no longer supported. Please use the v3 API.

The SKAO Binary Artefacts Repository (BAR) is an application that enables publishing and storing binary artefacts so they are archived and made available as part of the SKAO digital infrastructure.

Migrating to BAR

Migration Guidelines for Binary Artefacts Repository (BAR)

Repository and artefacts

Harbor has been selected as the preferred solution for storing artefacts within SKAO. This technology includes two main concepts: repository and artefact. A repository is identified by a name and is composed of a collection of artefacts. An artefact is identified by a tag (hereby, version) and a unique SHA-256 hash (hereby, digest) and can be composed of many files (hereby, assets), each identifiable by the file name or the digest.

The SKAO BAR allows SKAO developers (or Guests) to view and upload (subject to policies) artefacts to the available repositories. No conversion will be done and the uploaded files will be the exact same ones that will be downloaded.

Even if it is not mandatory, users are encouraged to provide metadata through annotations, because that provides more information about a given artefact.

Using RAW Artefacts

Due to the non-standard nature of RAW artefacts, these do not have a universal standardised tool to manage them and instead go on a project-by-project basis.

In an effort to align their usage inside the SKAO, we have defined a procedure to follow when creating and using RAW artefacts, and BAR is now the standard tool to be used when publishing or downloading artefacts of this nature.

Security

To be able to interact with the BAR UI the user is either required to be part of the SKAO group in Gitlab (for more information on this, please check the Gitlab Configuration page) or to log in as Guest. Binary artefacts are immutable; they cannot be changed and they cannot be deleted. Users can also directly use the BAR API which requires a valid API Key (JWT Token). To request one, please create an STS ticket and provide the repositories and artefact names you want to have access to.

What’s new

The new version of BAR provides some new functionality:

Multiple repositories support: Users can now access artefacts in different repositories
Improved artefact’s metadata: Users can now see individual assets’ digest, size and artefact metadata
Copy URLs: Users can easily copy URLs to download artefacts and artefacts’ assets
Presign URLs: Users can presign URLs to download artefacts and artefacts’ assets. These URLs carry their own signature, allowing them to be shared with anyone
Permalink URLs: Users can create permalink URLs to download artefacts and artefacts’ assets. These URLs carry their own signature, allowing them to be shared with anyone
Multiple compressed formats: Artefacts can be downloaded with their assets in zip or tar.gz formats
Custom downloads: Users can create custom compressed (default to zip) downloads (and presign them too) to include any asset they wish
Manifest View: Users can easily read the manifest of artefacts that have a valid MANIFEST.skao.int asset

Repositories

This new version provides support for multiple repositories. Currently, we support:

external-artefacts: No naming or versioning constraints (other than requiring sane values)
raw-artefacts: SKA standard naming (ska-<project>[-<other>…]) and versions must follow semantic versioning

These specifics are validated in both the UI and the API.

Annotations

Annotations play a key role into identifying the provenance and contents of an artefact. The following annotations are recommended to be added:

org.opencontainers.image.url: URL to the artefact’s project
org.opencontainers.image.source: URL to the artefact’s source (e.g: pipeline, project)
org.opencontainers.image.revision: Artefact’s revision (e.g: commit, version)
org.opencontainers.image.documentation: URL to the artefact’s documentation page
org.opencontainers.image.vendor: Artefact’s vendor
org.opencontainers.image.authors: Set to override the package author, as it defaults to the authenticated user

Ideally, a MANIFEST.skao.int asset should be added as it can be used to complement the annotations, providing even more information.

BAR UI

Note

Names of repositories and artefacts portrayed in the examples below might not be representative.

The UI enables users to:

Search & Browse: Find artefacts quickly using a responsive search with filtering options.
Download Artefacts: Retrieve specific artefacts, including different versions, with an intuitive interface.
Upload & Manage: Securely upload new artefacts, attach metadata, and ensure proper versioning.
Presign/Permalink Downloads: Create presigned or permanent links to download artefacts and individual assets, with configurable TTL.
Contextualized UI: Users mostly see what they can operate on, items are hidden if the user cannot act on them.

Repositories

Users can see all the repositories available. It displays the number of artefacts in that repository, as well as the last time it was updated and its visibility. If a user does not have permissions to a given repository, it will show up greyed out. This table can be sorted by name and update date.

Artefacts

Users can list the artefacts in a repository, as well as search them by name as shown in the example:

On each artefact, we have two possible actions: create a new version (‘+’ sign) or view the existing versions (dropdown).

Here we are presented with each version’s tags, the author, creation date, size and number of assets, as well as a set of actions. This table can be sorted by tag, author, creation date, size and the number of assets.

Tag: Shows the latest tag of this version. If other tags exist pointing to the same version, a badge will show their count. Hovering shows all available tags
Author: The author of the version
Created At: The version’s creation date
Size: The version’s size in the upstream storage. This is NOT indicative of the artefact’s size on disk as that depends on the format we download it as, as well as compression parameters
Assets: Number of assets in this version

We can also do a number of actions:

Download: Downloads the artefact as a zip with all assets included
Copy URL: Copies the API url to this artefact (as zip)
Download as .tar.gz: Downloads the artefact as a tar.gz with all assets included
Custom Download: Download the artefact using either zip or tar.gz and select individual assets
Presign Download: Create a presigned URL to download the artefact using either zip or tar.gz and select individual assets
Permalink: Create a permanent link to this artefact (as zip)
View Manifest: Visualize the artefact’s manifest when available

On the left we can also see more details about this artefact:

Here we can visualize some of the same information, as well as all the annotations (excluding the ones that get presented in a non-list format) of the artefact. It is very important to add meaningful information as annotations, as that allows users to know more about a given artefact.

In the assets list, we can see each of the assets’ digests and sizes, as well as some actions:

Download: Downloads the asset
Copy URL: Copies the API url to download this asset
Presign Download: Create a presigned URL to download the asset
Permalink: Create a permanent link to this asset

Uploads

New artefacts can be uploaded into BAR when the user has permissions to do so. If they do not, the UPLOAD button will not be visible. We can also click on the plus sign of a given artefact to create a new version:

In this case, the name is set and the latest published tag and its upload date is visible at the top, for guidance.

The upload dialog does per-repository checks, according to the rules in Repositories. It also requires at least one asset and non-duplicate annotations. When all the inputs are correct, users can click UPLOAD. Due to the upstream storage nature, the upload is done in two stages, represented in the UI:

Client -> BAR: Progress bar in SKAO blue
BAR -> Harbor: Progress bar in SKAO magenta

Please remember to add your annotations.

Gitlab Pipeline

To publish your artefacts to BAR (raw-artefacts), you should use the Gitlab pipeline job provided for that purpose. In your .gitlab-ci.yml file:

In the include section:

- project: 'ska-telescope/templates-repository'
  file: 'gitlab-ci/includes/raw.gitlab-ci.yml'

Currently, you also need to opt in to use BAR. In the variables section:

variables:
    CAR_RAW_REPOSITORY_USE_BAR: "true"
    ...

If you want to change the repository you are pushing to, you can also override the group’s variable:

variables:
    CAR_RAW_REPOSITORY_USE_BAR: "true"
    CAR_RAW_BAR_REPOSITORY_URL: https://binary.artefact.skao.int/api/v3/repositories/<some-repository>
    ...

You need to have, when this job executes, the artefacts ready for packaging:

└── raw
    └── ska-some-raw-artefact
        ├── file.bin
        └── some-directory
            ├── ...
            └── another-file.bin

The raw artefact pipeline machinery will take care of creating the appropriate manifest file. The final artefact in BAR will have two assets: the manifest and a bundled .tar.gz with all the contents of the artefact.

BAR API

Note

Names of repositories and artefacts portrayed in the examples below might are not representative

The API implements all of the artefact handling and always requires authentication and provides an extensive documentation. As mentioned before, users MUST have a valid JWT token to be passed as Bearer for authentication.

Different to the v1 and v2 APIs, the v3 API:

Requires a Bearer token
Has RBAC - Role-based Access Control - to control user operations
Has auditing of every changing action
Uses chunked transfers for both upload and download operations

Examples

Let’s now see some examples of how to use the API. For ease of use, we set:

export BAR_JWT=<your jwt token>
export BAR_API_URL=https://binary.artefact.skao.int

Identity lookup

Users can know more about their identity by calling:

curl -ssL -H "Authorization: Bearer ${BAR_JWT}" "${BAR_API_URL}/api/user/lookup"

{
    "detail": "Invalid token"
}

Using a valid token:

curl -ssL -H "Authorization: Bearer ${BAR_JWT}" "${BAR_API_URL}/api/user/lookup"

{
    "ids": [
        "pedroosorio"
    ],
    "emails": [
        "pedroosorio.eeic@gmail.com"
    ],
    "groups": [
        "ska-telescope",
        "ska-telescope/ska-dev",
        "ska-telescope/sdp",
        "ska-telescope/ska-dev/skao-team-system",
        "ska-telescope/ska-dev/dm",
        "ska-telescope/ska-dev/skanet"
    ],
    "roles": [
        "editor",
        "ska-dev"
    ],
    "attributes": {
        "iss": "https://binary.artefact.skao.int",
        "aud": "https://binary.artefact.skao.int"
    }
}

The most important part of this identity lookup is the roles section. This is set by the RBAC authorization system in the API and lets us know which roles are associated with your identity.

List repositories

Note

Listing endpoints (/repositories, /repositories/<repository>/artefacts, /repositories/<repository>/artefacts/<artefact>/versions are paginated)

curl -ssL -H "Authorization: Bearer ${BAR_JWT}" "${BAR_API_URL}/api/v3/repositories"

{
    "items": [
        {
            "name": "external-artefacts",
            "artefact_count": 15,
            "artefacts": [],
            "creation_time": "2025-10-02T13:35:55.408Z",
            "update_time": "2025-10-02T13:35:55.408Z",
            "public": false,
            "options": {
                "public": true,
                "enforce_semver": false,
                "enforce_ska_naming_pattern": false
            }
        },
        {
            "name": "raw-artefacts",
            "artefact_count": 18,
            "artefacts": [],
            "creation_time": "2026-01-27T11:26:59.598Z",
            "update_time": "2026-01-27T11:26:59.598Z",
            "public": true,
            "options": {
                "public": false,
                "enforce_semver": true,
                "enforce_ska_naming_pattern": true
            }
        }
    ],
    "total": 2
}

Get Repository

We can get repositories’ information (with artefact information):

curl -ssL -H "Authorization: Bearer ${BAR_JWT}" "${BAR_API_URL}/api/v3/repositories/external-artefacts"

{
    "name": "external-artefacts",
    "artefact_count": 15,
    "artefacts": [
        {
            "name": "ska-mid-cbf-talondx",
            "project_name": "external-artefacts",
            "version_count": 3,
            "creation_time": "2025-12-19T20:51:51.494Z",
            "update_time": "2026-02-03T11:41:26.468Z"
        },
        ...
    ],
    "creation_time": "2025-10-02T13:35:55.408Z",
    "update_time": "2025-10-02T13:35:55.408Z",
    "public": false,
    "options": {
        "public": true,
        "enforce_semver": false,
        "enforce_ska_naming_pattern": false
    }
}

List Artefacts

We can get list and search repository artefacts:

curl -ssL -H "Authorization: Bearer ${BAR_JWT}" "${BAR_API_URL}/api/v3/repositories/external-artefacts/artefacts?search=talon"

{
    "items": [
        {
            "name": "ska-mid-cbf-talondx",
            "project_name": "external-artefacts",
            "version_count": 3,
            "creation_time": "2025-12-19T20:51:51.494Z",
            "update_time": "2026-02-03T11:41:26.468Z"
        },
        {
            "name": "ska-mid-cbf-talondx-pst",
            "project_name": "external-artefacts",
            "version_count": 2,
            "creation_time": "2025-12-17T18:40:08.506Z",
            "update_time": "2025-12-17T18:40:08.506Z"
        }
    ],
    "total": 2
}

Get Artefacts

We can get an artefact, with its versions, by doing:

curl -ssL -H "Authorization: Bearer ${BAR_JWT}" "${BAR_API_URL}/api/v3/repositories/raw-artefacts/artefacts/ska-mid-cbf-talondx"

{
    "name": "ska-mid-cbf-talondx",
    "project_name": "raw-artefacts",
    "version_count": 14,
    "versions": [
        {
            "id": 466383,
            "digest": "sha256:5b969f571546a9892f86b9a029414d0b4e30f264dfa9ec71a37310b921781211",
            "size": 48344304,
            "push_time": "2026-02-03T11:49:18.946Z",
            "pull_time": "0001-01-01T00:00:00.000Z",
            "annotations": {
                "org.opencontainers.image.authors": "willkamp",
                "org.opencontainers.image.description": "[{\"name\": \"ska-mid-cbf-talondx-1.1.5.tar.gz\", \"digest\": \"sha256:9053d628c137b02d2a8b5dceb1b4b63bcef614d9cb1dc63181d02f3d2c4b19ad\", \"size\": 48341743}, {\"name\": \"MANIFEST.skao.int\", \"digest\": \"sha256:6cccb0b524c8dde24bb55ebbf015900f4b13d69d8c1b50ba30d1fe5aa020dc79\", \"size\": 898}]",
                "org.opencontainers.image.documentation": "https://gitlab.com/ska-telescope/ska-mid-cbf-talondx",
                "org.opencontainers.image.revision": "93a64a223f7f93e59912a033f93646159e92ee81",
                "org.opencontainers.image.source": "https://gitlab.com/ska-telescope/ska-mid-cbf-talondx/-/jobs/11588308625",
                "org.opencontainers.image.title": "ska-mid-cbf-talondx",
                "org.opencontainers.image.url": "https://gitlab.com/ska-telescope/ska-mid-cbf-talondx",
                "org.opencontainers.image.vendor": "skao.int",
                "org.opencontainers.image.version": "1.1.5"
            },
            "tags": [
                {
                    "name": "1.1.5",
                    "push_time": "2026-02-03T11:49:19.083Z"
                }
            ],
            "assets": [
                {
                    "name": "ska-mid-cbf-talondx-1.1.5.tar.gz",
                    "digest": "sha256:9053d628c137b02d2a8b5dceb1b4b63bcef614d9cb1dc63181d02f3d2c4b19ad",
                    "size": 48341743
                },
                {
                    "name": "MANIFEST.skao.int",
                    "digest": "sha256:6cccb0b524c8dde24bb55ebbf015900f4b13d69d8c1b50ba30d1fe5aa020dc79",
                    "size": 898
                }
            ]
        },
        ...
    ],
    "creation_time": "2026-01-27T12:04:42.115Z",
    "update_time": "2026-01-27T12:04:42.115Z"
}

And we can view any version by doing:

curl -ssL -H "Authorization: Bearer ${BAR_JWT}" "${BAR_API_URL}/api/v3/repositories/raw-artefacts/artefacts/ska-mid-cbf-talondx/versions/1.1.6"

{
    "id": 449044,
    "digest": "sha256:4e1c002f30cca67aa988723c53fd0b6f91c18931bb366676fe6fa890cbb8520c",
    "size": 48139693,
    "push_time": "2026-01-27T12:04:42.317Z",
    "pull_time": "0001-01-01T00:00:00.000Z",
    "annotations": {
        "org.opencontainers.image.authors": "pedroosorio",
        "org.opencontainers.image.description": "[{\"name\": \"MANIFEST.skao.int\", \"digest\": \"sha256:58d4ef6e35f2dfbd44f611ba468ad3c64cb406f9f22f9df4e949a9d0f0652657\", \"size\": 915}, {\"name\": \"ska-mid-cbf-talondx-1.1.6.tar.gz\", \"digest\": \"sha256:3113faaecee0928d83fd4689db3958f1df56317e9c93bd9f06923a452b228825\", \"size\": 48137112}]",
        "org.opencontainers.image.documentation": "https://gitlab.com/ska-telescope/ska-mid-cbf-talondx",
        "org.opencontainers.image.revision": "323fee574883762676a0cc0d7f384bfdcf103f78",
        "org.opencontainers.image.source": "https://gitlab.com/ska-telescope/ska-mid-cbf-talondx/-/jobs/12879527937",
        "org.opencontainers.image.title": "ska-mid-cbf-talondx",
        "org.opencontainers.image.url": "https://gitlab.com/ska-telescope/ska-mid-cbf-talondx",
        "org.opencontainers.image.vendor": "skao.int",
        "org.opencontainers.image.version": "1.1.6"
    },
    "tags": [
        {
            "name": "1.1.6",
            "push_time": "2026-01-27T12:04:42.457Z"
        }
    ],
    "assets": [
        {
            "name": "MANIFEST.skao.int",
            "digest": "sha256:58d4ef6e35f2dfbd44f611ba468ad3c64cb406f9f22f9df4e949a9d0f0652657",
            "size": 915
        },
        {
            "name": "ska-mid-cbf-talondx-1.1.6.tar.gz",
            "digest": "sha256:3113faaecee0928d83fd4689db3958f1df56317e9c93bd9f06923a452b228825",
            "size": 48137112
        }
    ]
}

Note that now we can see:

Digests and all metadata
All of this version’s tags
All of the assets and their digests

Querying by digest yields the same output:

curl -ssL -H "Authorization: Bearer ${BAR_JWT}" "${BAR_API_URL}/api/v3/repositories/raw-artefacts/artefacts/ska-mid-cbf-talondx/versions/sha256:4e1c002f30cca67aa988723c53fd0b6f91c18931bb366676fe6fa890cbb8520c"

{
    "id": 449044,
    "digest": "sha256:4e1c002f30cca67aa988723c53fd0b6f91c18931bb366676fe6fa890cbb8520c",
    "size": 48139693,
...

Optionally, we can download it as zip or tar.gz:

curl -LOJ -H "Authorization: Bearer ${BAR_JWT}" "${BAR_API_URL}/api/v3/repositories/raw-artefacts/artefacts/ska-mid-cbf-talondx/versions/1.1.6?format=zip"

$ file ska-mid-cbf-talondx-1.1.6.zip

ska-mid-cbf-talondx-1.1.6.zip: Zip archive data, at least v2.0 to extract, compression method=deflate

curl -LOJ -H "Authorization: Bearer ${BAR_JWT}" "${BAR_API_URL}/api/v3/repositories/raw-artefacts/artefacts/ska-mid-cbf-talondx/versions/1.1.6?format=tar"

$ file ska-mid-cbf-talondx-1.1.6.tar.gz

ska-mid-cbf-talondx-1.1.6.tar.gz: gzip compressed data, was "", last modified: Wed Feb  4 11:51:10 2026, max compression, original size modulo 2^32 48148480

Get Artefact Assets

Above we saw how to list the assets of a file. We can list them also with:

curl -sSL -H "Authorization: Bearer ${BAR_JWT}" "${BAR_API_URL}/api/v3/repositories/raw-artefacts/artefacts/ska-mid-cbf-talondx/versions/1.1.6/assets"

[
    {
        "name": "MANIFEST.skao.int",
        "digest": "sha256:58d4ef6e35f2dfbd44f611ba468ad3c64cb406f9f22f9df4e949a9d0f0652657",
        "size": 915
    },
    {
        "name": "ska-mid-cbf-talondx-1.1.6.tar.gz",
        "digest": "sha256:3113faaecee0928d83fd4689db3958f1df56317e9c93bd9f06923a452b228825",
        "size": 48137112
    }
]

We can get them by filename or digest as well:

curl -sSL -H "Authorization: Bearer ${BAR_JWT}" "${BAR_API_URL}/api/v3/repositories/raw-artefacts/artefacts/ska-mid-cbf-talondx/versions/1.1.6/assets/ska-mid-cbf-talondx-1.1.6.tar.gz"

Or:

curl -sSL -H "Authorization: Bearer ${BAR_JWT}" "${BAR_API_URL}/api/v3/repositories/raw-artefacts/artefacts/ska-mid-cbf-talondx/versions/1.1.6/assets/sha256:3113faaecee0928d83fd4689db3958f1df56317e9c93bd9f06923a452b228825"

In both cases, we get:

{
    "name": "ska-mid-cbf-talondx-1.1.6.tar.gz",
    "digest": "sha256:3113faaecee0928d83fd4689db3958f1df56317e9c93bd9f06923a452b228825",
    "size": 48137112
}

We can also download them:

curl -sSL -H "Authorization: Bearer ${BAR_JWT}" "${BAR_API_URL}/api/v3/repositories/raw-artefacts/artefacts/ska-mid-cbf-talondx/versions/1.1.6/assets/ska-mid-cbf-talondx-1.1.6.tar.gz?format=raw"

$ file ska-mid-cbf-talondx-1.1.6.tar.gz

ska-mid-cbf-talondx-1.1.6.tar.gz: gzip compressed data, from Unix, original size modulo 2^32 185262080

Presign and Permalinks

We can now presign and create permanent links for artefacts and assets. For that, all we need to do is do a POST request to the endpoint we would like to presign and configure a valid TTL (equal to or under 24h) in minutes.

This applies to any query parameter combination, and any change to the URL (_i.e._: different query parameters) will result in a FORBIDDEN response.

curl -X POST -sSL -H "Authorization: Bearer ${BAR_JWT}" "${BAR_API_URL}/api/v3/repositories/raw-artefacts/artefacts/ska-mid-cbf-talondx/versions/1.1.6/permalink?format=tar&include=MANIFEST.skao.int"

{
    "url": "https://binary.artefact.skao.int/api/v3/repositories/raw-artefacts/artefacts/ska-mid-cbf-talondx/versions/1.1.6/assets/ska-mid-cbf-talondx-1.1.6.tar.gz?format=raw&sig=Uw-b2_1QvI89mkr79jUCgckmSAZblUSBdHvNzadxO1sEu8-r-FX9mx..."
}

curl -LOJ https://binary.artefact.skao.int/api/v3/repositories/raw-artefacts/artefacts/ska-mid-cbf-talondx/versions/1.1.6?format=tar&include=MANIFEST.skao.int&sig=YSUjT8GOciF-x-N9EtOA9fSAmNmSz...

$ tar -tvf ska-mid-cbf-talondx-1.1.6.tar.gz

-rw-r--r-- 0/0             915 1970-01-01 01:00 MANIFEST.skao.int

Presigned URLs have a configurable TTL:

curl -X POST -sSL -H "Authorization: Bearer ${BAR_JWT}" "${BAR_API_URL}/api/v3/repositories/raw-artefacts/artefacts/ska-mid-cbf-talondx/versions/1.1.6/assets/ska-mid-cbf-talondx-1.1.6.tar.gz/presign?ttl=60"

{
    "url": "https://binary.artefact.skao.int/api/v3/repositories/raw-artefacts/artefacts/ska-mid-cbf-talondx/versions/1.1.6/assets/ska-mid-cbf-talondx-1.1.6.tar.gz?format=raw&sig=Uw-b2_1QvI89mkr79jUCgckmSAZblUSBdHvNzadxO1sEu8-r-FX9mx..."
}

Upload an artefact

To upload, we must provide:

Name: Specified in path
Version: Specified in the form
Assets: Specified in the form
Annotations: Specified in the form

export ARTEFACT=devportal-test
now=$(date)
export VERSION=$(date +"%Y.%m.%d.%H%M%S")
export ASSETS=(/tmp/file1.bin /tmp/file2.bin)

export PKG_AUTHORS="developer.skao.int"
export PKG_URL="https://developer.skao.int/en/latest/tools/skao-bar.html"
export PKG_SOURCE="https://developer.skao.int/en/latest/tools/skao-bar.html"
export PKG_DOCUMENTATION="https://developer.skao.int/en/latest/tools/skao-bar.html"
export PKG_DOCUMENTATION="https://developer.skao.int/en/latest/tools/skao-bar.html"
export PKG_REVISION="$now"
export PKG_VENDOR="skao.int"

assets_args=()
for f in $ASSETS; do
    assets_args+=(-F "files=@${f}")
done
annotations_json=" $(
    jq -nc \
        --arg authors "$PKG_AUTHORS" \
        --arg url "$PKG_URL" \
        --arg source "$PKG_SOURCE" \
        --arg version "$VERSION" \
        --arg revision "$PKG_REVISION" \
        --arg documentation "$PKG_DOCUMENTATION" \
        --arg vendor "$PKG_VENDOR" \
        '{
            "org.opencontainers.image.authors": $authors,
            "org.opencontainers.image.url": $url,
            "org.opencontainers.image.source": $source,
            "org.opencontainers.image.version": $version,
            "org.opencontainers.image.revision": $revision,
            "org.opencontainers.image.documentation": $documentation,
            "org.opencontainers.image.vendor": $vendor
        } | with_entries(select(.value != ""))
        '
)"

Now we can upload:

curl -N -X POST -sSL -H "Authorization: Bearer ${BAR_JWT}" "${BAR_API_URL}/api/v3/repositories/external-artefacts/artefacts/${ARTEFACT}/versions" \
    "${assets_args[@]}" \
    -F "annotations=${annotations_json}" \
    -F "version=${VERSION}"

event: upload_started
data: {"status": 102, "total_bytes": 4194304}

event: upload_progress
data: {"status": 102, "sent_bytes": 2097152, "bytes_sent": 2097152, "total_bytes": 4194304, "percent": 50}

event: upload_progress
data: {"status": 102, "sent_bytes": 4194304, "bytes_sent": 4194304, "total_bytes": 4194304, "percent": 100}

event: upload_complete
data: {"status": 201}

Or even, on conflict:

{"detail":"devportal-test:2026.02.04.151410 already exists. Please use a different version or issue a PUT request to overwrite."}

As BAR needs to repackage and stream the artefact to Harbor, it responds using Server-side events that can be easily parsed. Also, it allows to follow up the upload progress and get error information, as this example:

event: upload_started
data: {"status": 102, "total_bytes": 4194304}

event: upload_error
data: {"status": 500, "detail": "Issue retrieving session url: {'errors': [{'code': 'UNAUTHORIZED', 'message': 'unauthorized to access repository: external-artefacts/some-artefact, action: push: unauthorized to access repository: external-artefacts/some-artefact, action: push'}]}"}

Finally, one can get the artefact information by searching the latest pushed one:

curl -ssL -H "Authorization: Bearer ${BAR_JWT}" "${BAR_API_URL}/api/v3/repositories/external-artefacts/artefacts/devportal-test/versions?pageSize=1&sortBy=push_time&sortDir=asc"

{
    "items": [
        {
            "id": 466588,
            "digest": "sha256:c99f41c2f7509764cc825b9598ebfa12fd6330cc600bc1db2e719ecc0308be4d",
            "size": 4195840,
            "push_time": "2026-02-04T15:14:20.498Z",
            "pull_time": "0001-01-01T00:00:00.000Z",
            "annotations": {
                "org.opencontainers.image.authors": "developer.skao.int",
                "org.opencontainers.image.description": "[{\"name\": \"file1.bin\", \"digest\": \"sha256:595355822c681ee6200a42369fede21e8af6a6ce170ebe0e1d00b34a3e4442be\", \"size\": 2097152}, {\"name\": \"file2.bin\", \"digest\": \"sha256:8276b3f60bbe5c69766203013a5ac309a5c0e8073e920b87ef642aaa3d1bb354\", \"size\": 2097152}]",
                "org.opencontainers.image.documentation": "https://developer.skao.int/en/latest/tools/skao-bar.html",
                "org.opencontainers.image.source": "https://developer.skao.int/en/latest/tools/skao-bar.html",
                "org.opencontainers.image.title": "devportal-test",
                "org.opencontainers.image.url": "https://developer.skao.int/en/latest/tools/skao-bar.html",
                "org.opencontainers.image.vendor": "skao.int",
                "org.opencontainers.image.version": "2026.02.04.151410"
            },
            "tags": [
                {
                    "name": "2026.02.04.151410",
                    "push_time": "2026-02-04T15:14:20.635Z"
                }
            ],
            "assets": [
                {
                    "name": "file1.bin",
                    "digest": "sha256:595355822c681ee6200a42369fede21e8af6a6ce170ebe0e1d00b34a3e4442be",
                    "size": 2097152
                },
                {
                    "name": "file2.bin",
                    "digest": "sha256:8276b3f60bbe5c69766203013a5ac309a5c0e8073e920b87ef642aaa3d1bb354",
                    "size": 2097152
                }
            ]
        }
    ],
    "total": 2,
    "next": "/api/v3/repositories/external-artefacts/artefacts/devportal-test/versions?pageSize=1&sortBy=push_time&sortDir=asc&page=2"
}

Or view it in the UI:

SKAO Binary Artefacts Repository (BAR)

Migrating to BAR

Repository and artefacts

Using RAW Artefacts

Security

What’s new

Repositories

Annotations

BAR UI

Login

Repositories

Artefacts

Uploads

Gitlab Pipeline

BAR API

Examples

Identity lookup

List repositories

Get Repository

List Artefacts

Get Artefacts

Get Artefact Assets

Presign and Permalinks

Upload an artefact