 tool, I wish more teams realized the significant impact that customer support can have on your overall experience and the effectiveness of the tool in your workflow. In my role, I hear lots of stories from Cloudsmith customers about the poor support they received from past vendors and the disruptions it caused—a shortcoming they only discovered after they were live with the vendor.

But this disappointment and frustration is avoidable. You can gauge the quality of a vendor’s customer support before signing the contract—

 you evaluate support as part of your selection process. It may be a little harder to verify than product features and functionality because it’s less tangible and assessment requires some personal experience and interaction, but it’s not difficult. To help, here are my 12 signs that a vendor will provide the support and guidance you need for ongoing success:

In the initial phase of shopping around, when you’re browsing vendors’ websites but not quite ready to talk to sales, here are three encouraging signs:

If a vendor provides support to every paid tier they offer, it’s a strong signal that they care about all of their customers. It suggests that they want everyone to get maximum use of their product with minimal friction and have a ‘no customer left behind’ ethos. Visit their pricing page to check (for example, here are 

). If you don’t see support across all paid plans, it could mean you might have to upgrade to a higher-tier plan before the vendor’s technical support will unblock you.

Good documentation is essential for self-reliance and a positive user experience, but what does ‘good’ look like? In my experience, these are early signs of quality documentation:

 or help hub full of product documentation;

 to help you get the max from your investment;

, logically structured, easy to follow, and uses technical terms correctly;

 so you can clearly tell which version(s) of the product the documentation applies to (particularly important when considering on-premises or hybrid vendors that are maintaining multiple versions of the their platform); and

 to documentation, which indicates that the vendor is refreshing its materials to reflect improvements and changes within its platform to ensure accuracy.

You can learn a lot about a vendor’s technical support and customer experience by browsing 

 or other social media. Filter the reviews by keywords such as ‘support,’ ‘issue,’ or ‘team’ to quickly get a picture of how current users feel about the support they’re getting.

Once you have an account, whether that’s for a short-term free trial or a longer proof-of-concept, you can gather more evidence of a vendor’s support style and capabilities. Here are a few indicators of long-term quality service during that short introductory period:

A vendor that makes it easy to reach a human through multiple channels (email, Slack, live chat, etc.), shows a willingness to be open, transparent, and responsive. Detailed responses that address the actual specifics of your query, rather than boilerplate replies, are also a good sign. Ultimately you should feel valued (like Cloudsmith customer Richard Vodden, below). A vendor that offers high quality support as the norm will be consistent and treat trial users with the same care as paying customers.

Subject matter expertise and empathy are cornerstones of exceptional support, and they show up in these key ways:

Frontline support quickly and easily understands the issue you describe.

They are just as knowledgeable about the role of their tool in your operations as they are about how their platform works, which ensures they have context for 

 it is so important to quickly provide solutions to your support requests.

They get that their service is critical to your success and treat your success as 

At Cloudsmith, our frontline support team is made up of experienced software engineers to ensure our team has the knowledge and empathy to effectively assist you if an issue arises.

When something goes wrong in their platform, good vendors own it. They tell you what went wrong, why, when it will be fixed, and they maintain transparency and trust with status updates. Quickly and openly communicating and resolving their own issues tells you a lot about a company’s culture and what treatment you can expect if an issue arises in 

In the final stage of your selection process, look for these signals around customer success:

A vendor committed to quality support has Service Level Objectives (SLOs) in place between its platform engineering team and its support team. While the Service Level Agreement (SLA) between the client and vendor often gets more attention, I believe the presence of these internal service targets are a more significant predictor of support quality. After all, a 12-minute response time that meets your SLA doesn’t matter if the engineers never fix the problem. SLOs are your assurance that changes will get actioned within specific timeframes and are what empower support teams to deliver a high quality of service through to resolution.

If the vendor’s sales team initiates conversations about their support and the top-notch experience their customers have, it’s a great sign they’re proud of their service and have proof to back up their claims.

Confirm who in your organization can contact support and whether there’s a cap on the number of support users and requests. Caps are a danger sign. Unlimited support requests for all users show that the vendor values removing friction and bottlenecks in software delivery and prioritizes its clients’ time and productivity.

If the sales team works to understand your long-term goals and vision, it indicates they see themselves as an active partner rather than just a supplier. Vendors with this mentality take a proactive approach to customer success, delivering value, and supporting clients throughout their journey.

Assigning a specific customer success manager to your organization shows commitment to your long-term success and ROI. Customer success teams focus on preventing issues, suggesting optimizations, and sharing best practices—helping you sidestep or mitigate day-to-day issues.

Often 80% of a vendor’s platform will meet your needs straight off the shelf, but a great vendor will consider options to help you get that last 20% of utility. This willingness to explore your use case and work with you to customize your deployment indicates flexibility and a customer-centric ethos. It shows they care about your experience and satisfaction and aim to provide the solution that works best for you—something PagerDuty's Dave Bresci discovered firsthand when they selected Cloudsmith.

Those are my 12 green flags that an artifact management vendor likely delivers outstanding customer support and has your success as their top priority

 into your vendor-comparison matrix to track which platforms get green flags and which get the reds. Then you can ensure the vendor you choose provides the proactive, empathetic, and knowledgeable customer experience necessary for your success.

If you’d like to include Cloudsmith in your shortlist, 

 with any questions you have about our customer experience and support services.

Nick Peacock

Senior Director, Customer Success

12 Signs of Stellar Support in an Artifact Management Vendor

Among the 30+ package formats that Cloudsmith supports, Helm Charts are particularly popular. Cloudsmith serves millions of Helm charts annually, with the number of customers using Cloudsmith as a Helm repository growing every month. These users leverage our support of Helm alongside our container registry to deploy and manage their Kubernetes clusters.

Given Cloudsmith’s universal package support, a common question we encounter is whether our container registries can host Helm Charts. This is an insightful question and one we wanted to provide some background on along with our answer.

The short answer is, you can use Cloudsmith to store your Helm charts alongside your Docker images thanks to Cloudsmith’s support for multi-format repositories. This gives you a unified platform for all your K8s needs, ensuring all your dependencies are stored, managed, and delivered from a single, secure source.

With the release of Helm v3.8.0, storing Helm Charts in OCI registries became the default (before v3.8.0, it was experimental). Kubernetes clusters rely on a container registry to source images, so it made sense that developers would be interested in a single place to store Helm Charts alongside container images. The 

Open Container Initiative Distribution Specification

 defines an API protocol to facilitate and standardize the distribution of content, and it’s designed to be agnostic of content types.

. Now, if you were a Kubernetes user, you needed to set up a container registry and a Chart Repository to manage your clusters fully. Two things to manage and maintain, and of course - less is always more!

 in 2019, and we have built on and enriched that support over the years. Cloudsmith offers Chart Repositories for both public and private repositories. Some of the key features of Cloudsmith’s support for Helm include:

 Cloudsmith fully supports both the verification and generation of Helm provenance files.

Proxying and caching from upstream repositories

: You can configure upstream Helm repositories that you wish to use for charts that are not available in your Cloudsmith repository. In addition, you can also choose to cache any requested charts for future use.

For public Helm charts, Cloudsmith will scan for licenses, and then lets you build policies on what licenses are allowed for use within your organization.

 to learn more about Cloudsmith’s support of Helm. And because Cloudsmith’s repositories are fully multi-format, you can store your Helm charts and container images in the same Cloudsmith repository. One location to rule them all (so to speak).

So what does it mean for users that Cloudsmith is a Chart Repository for Helm charts? The great news is, nothing! Cloudsmith is a fully featured Helm repository, we simply don’t use OCI as the storage mechanism under the hood.

To migrate Helm Charts to Cloudsmith from an OCI registry, it’s as simple as using helm pull, and then pushing the chart to a Cloudsmith repository!

Suppose we have a Helm Chart in an OCI registry (we can use Nginx as an example here). We can pull this chart with helm pull as follows:

Ok, great. we have pulled this chart successfully. Now it really is as simple as pushing this Chart to Cloudsmith using the Cloudsmith CLI and the cloudsmith push command:


We can then see the Helm Chart in our Cloudsmith repository, and of course any other artifacts we have there (Multi-Format goodness, yay!):

How Cloudsmith helps you streamline K8s workflows

Because Cloudsmith is a universal artifact management solution with multi-format repository support, you can use Cloudsmith to store your container images and Helm Charts alongside each other in one repository, streamlining your K8s workflow with a single source to secure, host and distribute the workflow dependencies.

So what are you waiting for? Join the growing number of customers who use Cloudsmith to make their Kubernetes lives easier :-)

Dan McKinney

Solutions Engineer

Streamline Kubernetes Workflows with Cloudsmith

Kubernetes has become the de facto platform for orchestrating containers. Open standards complement Kubernetes by defining best practices for its implementation. These standards are developed by the open-source Kubernetes community (not a single vendor), ensuring vendor neutrality, easier integration with other tools, and overall system efficiency.

, a Linux Foundation project, was created to establish open, industry-wide standards for container formats and runtimes. It focuses on two core specifications:

: A reference container runtime engine used by most container platforms, including Docker. It serves as the foundation for many modern runtime environments.

: Defines how containers are built, distributed, and executed. While Docker remains widely used, OCI represents the community's commitment to standardized, open container technologies.

, it became possible to use OCI-compliant container registries for storing and distributing chart packages. With the release of 

, OCI support moved from experimental to stable and is now enabled by default.

This shift has driven demand for registries that support Helm chart storage in OCI format. 

Cloudsmith is proud to be one such registry

, fully supporting Helm charts with OCI compliance.

Cloudsmith support moves from EA to GA for OCI

 released today (5th June 2025), we’re announcing full support for Helm OCI. Previously, Cloudsmith offered a Docker registry (

) that was fully compliant with the OCI v1.1 standard. While users could push any OCI artifact to this registry, non-Docker artifacts were still displayed as Docker packages.

This functionality had been marked as Early Access (EA) in our documentation, as the user experience was fully optimized only for Docker. Although users could technically push and pull any OCI artifact, display limitations persisted for non-Docker types.

With today’s update, we’ve significantly improved our support by fully enabling Helm OCI. We've reworked the implementation and introduced a dedicated endpoint (

) which allows users to push and pull Helm charts as OCI artifacts, now correctly identified and displayed as Helm packages.

In addition, we're introducing a compatibility bridge that enables legacy Helm charts and OCI-based Helm charts to coexist. We are now in a unique position to support legacy Helm chart repositories and OCI, allowing our users to push via legacy means and pull via OCI - offering greater flexibility and smoother transitions.

 is a tool that enables pushing, pulling, and managing 

 in OCI-compliant registries. It extends the OCI specification beyond container images, turning registries into general-purpose artifact stores.

 formalizes this approach, allowing for a broader range of artifacts, like SBOMs, Helm charts, and signatures, to be stored and retrieved without being disguised as container images. ORAS has become the 

 highlighted how ORAS is transforming registries into multi-purpose artifact platforms. They demonstrated pushing multi-architecture images along with their security metadata - all as native OCI artifacts.

As the ecosystem matures, there’s a clear trend: 

treating everything (from Helm charts to SBOMs) as first-class OCI artifacts

. At Cloudsmith, we're seeing growing demand for comprehensive support of these use cases, including secure metadata attachments and provenance tracking.

, which allows artifacts to reference related files such as SBOMs, signatures, or provenance records.

Nigel Douglas

Head of Developer Relations

Open Container Initiative (OCI) Support in Cloudsmith

Apache Maven is a popular and widely-used open-source build automation and project management tool primarily designed for Java projects.

We're excited to announce a major enhancement to our Maven repository support at Cloudsmith. As a Java developer, you can now upload and distribute 

 using Maven repositories, unlocking more flexible and powerful workflows for your projects.

Arbitrary files are files that are ignored by Maven unless explicitly included in the Project Object Model (

 configuration. This update means that Cloudsmith can now support unique package names that don't support Maven convention or use arbitrary classifiers or extensions, so really they should be able to upload any file regardless of the extension.

Previously, Cloudsmith Maven repositories only supported standard artifacts that followed the traditional 

). That meant non-standard files (such as custom dependencies, configuration files, or other useful assets) couldn’t be cached from upstream sources or uploaded directly.

you can now cache and distribute arbitrary files

, whether they’re pulled from upstream sources or uploaded directly using your preferred tooling.

Not every project follows the “standard” Maven structure (and that’s okay!). Whether you're dealing with:

Binary assets like .zip, .tar.gz, .exe, or .dmg

Configuration files, templates, or scripts

You can now fully embrace these flexible workflows without needing to hack around repository limitations. Cloudsmith's improved Maven support now includes:

: Cache and serve arbitrary files that don’t follow Maven’s strict packaging rules (even from external sources).

 Upload arbitrary files manually or automatically as part of your CI/CD pipeline.

 Use native tooling like Maven, Gradle, or SBT (or the Cloudsmith 

Java developers - we get it. Your workflows matter. Your tools should keep up.


That's why we're making Maven repository management smarter and more flexible - just for you. With Cloudsmith, your Java packages have never had it so good.

Are you ready to simplify your build and deployment workflows? 

Get started with Cloudsmith Maven repositories

 and explore our new arbitrary file support today!

Full Support for Arbitrary Files in Maven Repositories with Cloudsmith

As containerized environments evolve, effective artifact management is crucial for any organization using Kubernetes or similar ecosystems. Cloudsmith’s container registry now fully complies with the Open Container Initiative (OCI) distribution specification, allowing customers to store, secure, and distribute images and artifacts with greater efficiency.

This release marks an evolution in how Cloudsmith supports organizations, enabling streamlined workflows while ensuring compatibility with current and future industry standards.

With this update, Cloudsmith offers robust support for the OCI storage protocol and API format, including:

: Cloudsmith now supports the OCI storage protocol and API format, bringing greater flexibility and alignment with industry standards for artifact management.

Early Access for OCI Images and Artifacts

: With early access support, Cloudsmith customers can store, secure, and distribute generic OCI images and artifacts, including Helm V3 charts. Using ORAS, users can push and pull artifacts like SBOMs and attestations, strengthening control over containerized workflows.

: The Referrers API allows you to query an OCI registry for artifacts linked to a specific image or artifact, typically through reference or association. This feature is especially helpful for retrieving metadata such as attestations, SBOMs, signatures, or other security-related artifacts, offering a streamlined way to manage dependencies and related security information.

Key Benefits of Cloudsmith’s OCI-Compliant Registry

With Cloudsmith’s OCI-compliant container registry, organizations can unlock the following advantages:

: Integrate seamlessly with any OCI-compliant tools and services, enabling you to choose the right tools to fit your workflows and achieve optimal outcomes without compatibility issues.

: Rely on industry-standard specifications for container formats and image distribution, providing greater consistency, reliability, and peace of mind as you scale operations.

: As more technologies and ecosystems adopt the OCI specification, Cloudsmith’s platform will continue to support them, ensuring your workflows stay relevant and adaptable.

As we continue expanding support for OCI, expect updates on advanced Helm capabilities and additional security features for all supported artifact types.

Maia Livingstone

Campaign Manager

Securely Store and Distribute OCI Artifacts

As software complexity advances, understanding what’s happening across every part of your software supply chain becomes crucial. You need to see where artifacts are used, how secure they are, and whether they meet compliance standards.

The ability to capture this is known as observability. Observability goes beyond data collection to provide essential insights that help teams understand, troubleshoot, and enhance complex systems. It enables engineers to ask critical questions, anticipate issues, and respond proactively—fostering resilience and reliability.

Overcoming the Challenges of Limited Observability

Without good observability, teams are often left in the dark, relying on incomplete data and reactive troubleshooting when issues arise. This can lead to longer downtime, unexpected costs, and missed security risks, as there’s no clear visibility into where problems occur or why. The lack of insights also makes it harder to anticipate trends, manage resources efficiently, and ensure compliance, ultimately compromising system reliability and customer trust.

Knowing this, we wanted to take a step forward and create a solution that provided a quick turnaround on insights that drive immediate corrective action. As a result, Cloudsmith has launched an advanced observability suite, offering enterprises unparalleled insights into their software supply chain. With a fully redesigned user experience, customers can now make data-driven decisions more effectively, managing artifacts with greater precision and control.

Enhanced Observability for Usage Management

Cloudsmith’s advanced observability features give engineering managers and DevOps teams the insights needed to monitor and manage artifact quality and usage across their systems. These tools are built to handle complex, large-scale environments, helping teams track trends, accurately attribute costs, and proactively address risks—essential for maintaining control over a dynamic software supply chain.

"Cloudsmith's analytics and alerts are instrumental in helping us manage our usage more effectively and plan for increases in demand for software artifacts,...We can catch unexpected spikes in artifact consumption, improving our security posture and avoid usage surprises at the end of the month" Dave Bresci, Senior Manager, SRE, PagerDuty.

Cloudsmith’s new observability suite offers several key features geared to upgrading observability:

: Granular dashboards and reports provide a clear view of consumption patterns over time, enabling informed resource management.

: A centralized dashboard for policy violations, vulnerability data, and license tracking offers a straightforward way to assess and address organizational risks.

: Real-time notifications ensure that critical information on usage and policy adherence reaches the right teams when it’s needed most.

These features equip teams with the context and control required to navigate complex, large-scale environments effectively.

The new suite comes with a fully redesigned user experience, featuring streamlined navigation, enhanced performance, and a data-rich interface packed with deeper insights. Cloudsmith has tailored these improvements to ensure smooth, efficient access to critical data, making it well-suited for large-scale enterprise operations.

With this suite, organizations are empowered to navigate challenges confidently, drive smarter decision-making, and ensure their software supply chain remains both agile and secure.This isn’t just a tool - it’s a strategic advantage.

Unlock the full potential of your software supply chain with Cloudsmith’s advanced observability suite. See firsthand how our powerful analytics and real-time insights can help you optimize artifact usage, anticipate risks, and maintain compliance across your systems. Schedule a demo today to explore how Cloudsmith can give your team the visibility and control needed to drive smarter, data-driven decisions.

 and discover how Cloudsmith’s observability suite can transform your software management process and help you stay ahead of potential issues in your supply chain.

Introducing Cloudsmith’s Advanced Observability Suite for Enterprise Artifact Management

It’s a fairly common perception that a package repository is basically a file share or file storage, and perhaps for some of the most simple implementations, this is a reasonable analogy.

However, when thinking of Cloudsmith, this analogy misses a lot of important details that make Cloudsmith package repositories rather unique.

If you have used Cloudsmith, you may have noticed that when you publish/upload a package to Cloudsmith or fetch a package from a public package repository (Like Maven Central or PyPi) into Cloudsmith, the first thing that happens is that the package enters a “Synchronizing” state. What exactly is synchronizing?Put simply, synchronization is where Cloudsmith processes the uploaded/ingested package. But that still belies a lot of the detail. What possible processing could a package need? Well, quite a lot actually!

Some of the steps that synchronization/package processing involves are:

 - Setting up the initial state, tools and environment for synchronization.

 - Getting the package files from the upload storage location.

 - Extracting the package files and package assembly (layers and configs for Docker images, for example)

 - Once we have the complete package file set, we scan the files for trojans, malicious content etc.

 - Verify and generate package checksums and signatures, as well as parse and verify package metadata and licenses.

 - Local and Distributed Storage synchronization.

These processes are automatic, require no user interaction and run asynchronously on Cloudsmith's global infrastructure. They are a large part of what empowers Cloudsmith users to implement effective package controls. As they say, knowledge is power - and it’s by the process of synchronization that we gain the knowledge of packages.

Once a package has been synchronized, we can then use the metadata generated to apply things like Vulnerability, Licence and Package Deny policies, create a scoped access token, add tags to the package, or fire a webhook for specific packages/versions. The data generated from synchronization drives a lot of the subsequent actions and workflows that you can perform.

Also, you may encounter occasions where a package fails synchronization:

This is typically a good thing (contrary to initial impressions!) because it can alert you to a problem with the package itself such as invalid/missing/incorrect metadata (the package not meeting the specification for the package type, for example), the presence of Malware in the package, or that you are attempting to upload/publish a package that already exists in the repository (as above). Package synchronization is an essential step in verifying the “correctness” of a package and It’s always better to catch things earlier in your processes than later, as the cost of remediation rises dramatically the later issues are identified.

Cloudsmith Package Repositories do far more than just store your packages, and they have a lot more functionality than just storing your packages in an AWS S3 bucket or Azure Blob Storage, or spinning up a simplistic instance of a package repository. Packages in Cloudsmith repository are so much more than just “bits on disk”, and treating them as such is really doing them a disservice!

What happens when you upload a Package?

Package promotion workflows are a great way to isolate and protect production repositories, allowing progressive levels of security and permissiveness for development, staging, and production environments.

Once a binary is uploaded to Cloudsmith, it can move from development -> staging -> production, maintaining the integrity of the asset and its provenance trail. This migration takes place entirely within Cloudsmith; there’s no package delivery cost.

The differences between Dev, Staging and Production environments.

Cloudsmith's package promotion instructions- package copy/move actions

Complementary features that play nicely with package promotion, including webhooks, quarantining, policy management and upstreaming. These can be used together to create workflows and drive actions.

A Potential workflow for package promotion

Policy management that lets you set up policies that serve as prerequisites to package promotion.

Differences between Dev, Staging, and production environments

Typical software development organizations maintain three types of environments: development, stage, and production.

environment is used for developers early in the software process to see how new features will work, to try out improvements and pull in new dependencies or update existing dependencies.

 environment is used for testing integration and is a production-

environment that allows user creation without impacting production data. Only whitelisted IPs typically have access to Staging.

 environment is what end users are using on a live system.

Cloudsmith's package promotion workflows are powered by features to copy and move packages between repositories, usually for promoting immutable versions of packages between separate build, test, staging and production pipelines. The package that was verified in build is the same package in production when it gets promoted to there. Cloudsmith facilitates the automation of copying and moving packages using our command line interface (CLI).

 for vulnerabilities and license issues. This ensures that only secure and compliant artifacts are promoted through the pipeline, with policies applied to block or quarantine packages that fail these checks.

Let's see an example of moving a package in action:

 package was moved (or "promoted") from the source repository to the destination repository. Copying packages works the same, except it duplicates the package rather than moving it from the source to the destination.

In addition to moving and copying packages, you can also resync packages via the CLI, whereby the CLI will retry packages that have failed (for whatever reason) up to a configurable amount of attempts.

To see the full list of help for actions, run the following commands:

Package promotion on its own is great, and you can couple it with other features to create workflows and drive actions. Let's talk about tagging, webhooks, multiformat repos, vulnerability scanning, and setting up upstream.

 feature allows you to label your packages with tags like "dev", "staging", or "prod" as they move through your pipeline. These tags help in tracking packages across different environments, and enable targeted searches, filtering, and control over what artifacts are accessible. By using 

, you can automate package promotions based on tag transitions, such as promoting a "staging" package to "prod" once it passes certain tests). This enhances visibility and governance within your pipeline and simplifies the overall package management process.

Webhooks let apps send automated messages or information to other apps. 

 are great for integrating Cloudsmith with other systems in your build pipeline, by sending data or notifications to other tools in your stack and helping to enable automation across your workflows.

Cloudsmith has webhooks for vulnerability scanning. Anytime a scan is completed, Cloudsmith can dispatch a corresponding vulnerability webhook to trigger some action, like creating a Jira ticket.

Cloudsmith's vulnerability scanning is particularly effective when combined with upstreams. Upstream proxying and caching allow you to upload and use the packages you author in-house directly, while Cloudsmith fetches and caches your dependencies from public repositories like Maven Central or NuGet.org.

This enables you to use Cloudsmith as a first-class cache and a central source of truth for packages, to protect you from issues related to use of external services, such as downtime, rate limiting, or non-availability of a previously available package.

Packages fetched from a caching-enabled upstream will be automatically scanned for vulnerabilities for Ultra customers.

Multi-format repositories allow you to store artifacts of different formats in the same place. Organize your packages by environment, project, package type, or whatever way you see fit.

Package vulnerability scanning is a key step in securing your software delivery pipeline and reducing the risk of releasing insecure software into production.

Cloudsmith automatically scans every supported package format pushed to a Cloudsmith repository or fetched from a caching-enabled upstream.

Cloudsmith's vulnerability scanning feature is available for the following package formats:

Cloudsmith's Security Scanning page shows a breakdown of the number of packages scanned/not scanned, the age of scans, the pass/fail count overall and the maximum severity of those found.

Setup your Dev repository with upstreams and your Staging repos with no upstream

Push your package to Dev repository and tag the package with ‘dev’.

Automatically tag the package with ‘staging’ and move the package to the Staging repository when the results return with no vulnerabilities.NOTE: you may want to run more manual tests against this package before promoting it.

 for the examples below. The CLI interfaces with Cloudsmith's API and allows users, machines and other services to access and integrate smoothly with Cloudsmith without requiring explicit plugins or tools.

Setup your Dev repository with upstreams and your Staging repository with no upstreams

Create 2 repositories Dev and Staging by following the instructions 

.

Set up an upstream for the Dev repo by following the instructions 

A vulnerability scan is automatically triggered for supported packages every time they are pushed into a Cloudsmith repository. If you set up an upstream, your 3rd party dependencies are also scanned for vulnerabilities.

Cloudsmith Blog

12 Signs of Stellar Support in an Artifact Management Vendor

Streamline Kubernetes Workflows with Cloudsmith

Open Container Initiative (OCI) Support in Cloudsmith

Full Support for Arbitrary Files in Maven Repositories with Cloudsmith

Securely Store and Distribute OCI Artifacts

Introducing Cloudsmith’s Advanced Observability Suite for Enterprise Artifact Management

What happens when you upload a Package?

How to Manage Your Package Promotion Workflows with Cloudsmith

Level up your private npm registries in Deno with Cloudsmith

5 Lessons on the Evolution From DevOps to Platform Engineering

Cloudsmith ♥ OSS

Caching and Upstream Proxying For CRAN's R Packages