By submitting this form, you agree to our 

Explores AI-driven development, rising supply chain attacks, and new regulatory requirements.

2026 Artifact Management Report

For organizations, distributing software artifacts effectively is crucial to building strong developer relationships and delivering a seamless experience. Yet, managing and personalizing the distribution of software packages—like SDKs or container images—can be challenging. Cloudsmith, a leader in cloud-native artifact management, has introduced 

With Broadcasts, Cloudsmith customers can manage, brand, and personalize their software delivery, ensuring a developer-native experience that aligns with the organization’s identity and meets end users where they are.

Artifact management is, at its heart, about software distribution, and it’s a natural extension of Cloudsmith’s powerful package delivery network

,” said Alan Carson, co-founder and chief strategy officer at Cloudsmith. “

With Broadcasts, customers can take full control and deliver a branded, professional experience that fosters deeper, richer relationships with their customers.

The New Standard for Artifact Distribution

Broadcasts transforms software distribution with a streamlined, brandable interface that lets organizations control which software they publicly share. Cloudsmith has incorporated branding elements, custom domains, and analytics, enabling companies to present a unified, professional experience to developers and gain insights into usage.

Key Features and Benefits of Cloudsmith Broadcasts

Broadcasts offers a cohesive, branded distribution experience through these features:

: Set up and manage Broadcasts with an easy-to-use interface, providing exact control over which artifacts are distributed, reducing setup time and enabling faster delivery.

: Organizations can use custom domains and branding elements to create a distribution page that reflects their brand, providing a recognizable and professional experience.

: Get insights from download data to understand usage trends, identify revenue opportunities, and enhance brand value.

: Broadcasts integrates with native developer tooling, allowing end users to access artifacts through their preferred CLI or CI/CD tool, creating a smooth, workflow-friendly experience.

: Powered by Cloudsmith’s extensive network, Broadcasts ensures reliable, fast distribution worldwide with over 600 points of presence, so users receive content instantly.

How Broadcasts Solves Distribution Challenges

Cloudsmith’s Broadcasts tackles key software distribution challenges by providing tools to control, brand, and analyze distribution:

: Customized distribution pages create a seamless, familiar experience for users and reinforce brand identity.

: Analytics provide actionable information on download trends and engagement, supporting marketing strategies and potential revenue growth.

: Cloudsmith’s network offers high-speed, dependable distribution, allowing organizations to focus on engagement rather than infrastructure.

In a world where developer experience matters, Cloudsmith’s Broadcasts provides a powerful, flexible solution that simplifies software distribution, enhances brand presence, and delivers actionable insights.

Experience the future of artifact distribution with Cloudsmith Broadcasts. See firsthand how you can take control of your software delivery, personalize the experience for your end users, and gain powerful insights into your distribution channels. Schedule a personalized demo with one of our experts to explore how Broadcasts can elevate your organization’s developer engagement and streamline artifact management.

 and transform your software distribution with Cloudsmith.

Paul May

Senior Director, Product & Customer Experience

Elevating Software Distribution with Cloudsmith’s Broadcasts

In 2023, Kong’s frustration with its self-hosted distribution solution, Pulp, had reached a breaking point. For some time, the open-source solution, which met Kong’s needs in its early years, had been under strain. As growth made Kong responsible for an increasing share of the internet’s traffic, the criticality of Kong’s distribution ramped up as well. Seamless delivery of its software updates, upgrades, and patches became essential for its clients to maintain their functionality online.

According to Kong’s SVP of Engineering, Saju Pillai, the consequences of a Kong distribution failure could be considerable. “A two-day delay on our side in distributing a patch could translate into millions of dollars lost for an unfortunate customer,” he explains. “So the impact would be unusually high.”

The number of product versions Kong was supporting had grown, the number of assets requiring distribution was increasing, distribution of those assets was becoming more complex, and the tooling and team responsible for it had reached their limits. Challenges and frustrations included:

the cost and effort for three engineers to maintain their own instance of Pulp;

Cloudsmith x Kong

Kong’s VP of Engineering explains why Kong chose Cloudsmith and describes the impact of the switch.

By switching to Cloudsmith, Kong now enjoys specialized, fully-managed, high-volume software distribution on a global scale. “When you think about the amount of energy and time and money that companies spend solving the software distribution problem in-house," says Saju, "I don't think that can be properly justified, anymore, when Cloudsmith exists.”

With Cloudsmith, Kong has transformed its software distribution workflow and strengthened its operational efficiency and resilience. Notable improvements include:

agile delivery of custom solutions for design-partner clients;

“Once we got the bulk of our assets moved from Pulp into Cloudsmith, we saw an instant drop in escalations,” Saju explains. “The complaints have literally gone to zero.

“Cloudsmith is key to our CI/CD and DevOps stack now,” he adds. “It should be a tool in the DevOps toolkit for everyone.”

For the whole story on why Kong chose Cloudsmith and how life has improved there since the switch, 

Lee Skillen

Chief Technology Officer

Kong Entrusts Cloudsmith With Global Distribution

Software delivery is often the last, yet frequently neglected, mile of the development lifecycle. For independent software vendors (ISVs), SDK providers, and teams shipping internal tools, the “how” of distribution is just as critical as the “what.” Too often, teams find themselves building and maintaining custom download pages, hosting infrastructure, and complex access controls that add zero value to their core product. These DIY systems are expensive to run, difficult to scale globally, and notoriously easy to misconfigure from a security standpoint.

When software downloads live on generic, third-party domains or lack clear, professional access controls, you risk losing the very thing your product depends on: developer trust. Distribution is an early trust checkpoint for many developers. If a developer hesitates to adopt your software because the delivery method feels disconnected or insecure, you’ve hit a roadblock that slows down your entire adoption funnel.

Software distribution should meet basic expectations for security, access control, and traceability without requiring you to become an infrastructure company. 

Cloudsmith Broadcasts

Broadcasts is Cloudsmith’s built-in, dedicated software distribution capability designed for delivering packages to customers and partners. It allows your team to publish software through secure, branded endpoints hosted under your own domain. Essentially, it acts as a professional front door for your artifacts, abstracting away the headache of building or maintaining custom download portals.

Built on Cloudsmith’s cloud-native architecture, Broadcasts handles the heavy lifting of global scaling and replication. Whether you are distributing a public CLI tool to thousands of developers or a proprietary SDK to a handful of enterprise partners, Broadcasts ensures your software delivery is available, secure, and on brand. It supports both open-source and commercial distribution, and manages access through granular entitlements and seamless integration with native developer tools.

Professional delivery with your own branding

Your brand shouldn’t stop at your documentation page. Many teams struggle with package endpoints that feel disconnected from their identity, leading to confusion and reduced trust among the developer community. Broadcasts solve this by enabling teams to present their distribution experience with their own identity, featuring the same branding, domain, and look and feel that users expect.

By using custom domains and tailored presentation settings, you provide extra reassurance. When a user decides whether to install a package, seeing your company’s domain and branding reinforces that the software is authentic and supported.

Beyond aesthetics, Broadcasts give you control over the technical presentation of your packages. You can configure how to display package information, download links, and license details to end-users. This flexibility ensures that you are providing the exact context a developer needs to successfully integrate your software, all without compromising Cloudsmith’s built-in security and reliability.

Not all software is meant for everyone. Whether you are protecting commercial IP or managing internal tools, Broadcasts provide a range of access models to fit your distribution strategy.

For community tools or public-facing software, public Broadcasts make all packages from a repository openly accessible. This is ideal for increasing the reach of your software without forcing users through unnecessary authentication hurdles.

Protecting proprietary content–like premium SDKs or internal artifacts–is a major challenge for many organizations. Setting up secure, access-controlled methods often requires significant engineering time.

Private Broadcasts provide a dedicated, access-controlled portal where you manage access through secure entitlement tokens. This ensures that only authorized partners or internal teams can view and download your packages. It guarantees robust security, compliance, and IP protection without compromising the end-user experience. You get the security of a private repository with the professional interface of a public one.

The best distribution platform is the one developers don’t have to think about. Developers expect to fetch packages through native tools, whether it’s npm, pip, maven, or a system-level CLI. If your distribution method doesn’t align with these workflows, you create friction that slows down adoption.

Broadcasts are built to integrate directly with native developer tooling. Users can access artifacts through their preferred CLI or CI/CD tools, creating a smooth, workflow-friendly experience. By meeting developers where they already work, you remove the roadblocks that can stall the rollout of new software versions.

Distributing software shouldn’t be a black box. Many teams ship artifacts without knowing which versions users actually download, who is using them, or whether adoption is trending up or down.

Broadcasts include built-in analytics that provide clear visibility into software distribution and adoption. You can track:

: Understand the raw volume of software consumption.

: See which versions are popular and which are being phased out.

: Identify where in the world your users are located.

: Monitor trends over time to predict infrastructure needs or marketing success.

These insights help teams optimize their delivery strategies and understand user behavior more deeply. This data is accessible through both the Cloudsmith web app and the API, allowing you to feed these metrics into your own internal business intelligence tools.

One of the primary differentiators of Broadcasts is its ease of use compared to DIY alternatives. You don’t need to spend weeks designing a portal or configuring web servers.

You can enable a Broadcast instantly from any existing Cloudsmith repository. This immediately creates a professional interface for your end-users without the need for additional infrastructure.

Upload your logo, set your brand colors, and configure your custom domain.

: Navigate to your repository and enable the Broadcast feature.

: Choose between public or private access and generate entitlement tokens for your users if necessary.

: Monitor your performance through the built-in analytics dashboard.

For more information about specific settings, check out the 

The goal of Cloudsmith Broadcasts is to remove the burden of distribution infrastructure. By reducing operational overhead and security risks, Broadcasts help your team stay focused on what matters most: building your core product.

By aligning distribution with your brand identity and providing the tools for secure, manageable access, you can deliver a professional experience that reinforces trust and accelerates adoption. Stop building custom portals and start broadcasting your software with Cloudsmith.

 to discuss your unique distribution needs.

Jason Myers

Technical Content Marketer

Cloudsmith Broadcasts: Distribute software on your own terms

 and regain control via Cloudsmith's new bandwidth controls for Entitlement tokens. You can craft tokens with individual usage limits using the UI, API, and CLI, allowing you to decide the exact level of usage for each token.

Combining the new and existing limits for entitlement token, allowances are configurable to provide fine-grained control for any combination of properties. For example, the total amount of bandwidth, number of unique clients using a token, or the maximum number of downloads a token can perform on an individual token basis. Also, you can also scope your 

 for advanced control of tokens.

If you are a vendor, you may want to have tiered levels of token's for different users. Providing higher or even potentially unlimited allowances to your premium users is now possible, whilst maintaining control of your offering to free users with suitable limits.

The best part is you can provide a lifetime limit for a token, or you can configure a refresh period to refresh the limits after the period has elapsed. For example, a token with a 1 GB daily limit, will allow up to 1 GB of daily usage and more more. After 1 day has passed, the token will be reset allowing another 1 GB of daily usage.


Within the Cloudsmith UI for Entitlement tokens, you can edit individual tokens to provide visibility restrictions, usage limits, or even provide additional metadata on the token for your own internal requirements.

To provide a bandwidth restriction with a refresh period. You will need to select a unit of Bandwidth 

, and enter a corresponding unit of bandwidth you would like to restrict by (e.g., 

" refresh may be more than enough for most users but may prevent misuse of tokens from users accidentally using many TB's of data per month.

In this example, fine-grained bandwidth controls will be configured for the amount of bandwidth usage that token is allowed to consume every month. This is accomplished by selecting a few preset values and entering a bandwidth amount within the Edit Entitlement Token form.

To configure a 1GB bandwidth limit that resets monthly.

Presets provide values from "Never Reset" to a range between "Daily" to "Annual".

The number should be between 0 - 1000; you can go higher than 1000; however, the unit of bandwidth provides sensible defaults to keep values readable. (e.g. 1000000 bytes can instead be expressed as 1 Megabyte).

Values range from a single Byte to an insanely large number of Petabytes.

Finally, select Edit to save your changes to the token. These restrictions will take effect almost immediately.

If you wish to set your limits programmatically, entitlement restrictions are configurable using the 

.

Finally, the easiest way to get started with making programmatic changes to entitlement tokens and applying restrictions is via the 

. Using the following command, you can all visibility restrictions and usage limits for an entitlement token.

Dan McKinney

Solutions Engineer

Restore Authority with Token Bandwidth Controls!

IoT is slowly, quietly taking over the world. A few years ago, self-ordering fridges, driverless cars, and fully automated homes seemed like the stuff of dreams. And while the technology exists, rollout and adoption is slower than anticipated, amidst security and privacy concerns. That said, IoT is the future, and growth is steady, as the challenges of building and maintaining hundreds of thousands of devices per vendor are getting solved.

Today, there are billions of devices online; with an ultra-wide and global dispersal pattern from the factories that built them. Each device runs firmware, or more commonly a light-weight embedded OS and software written in performant languages like C++ or Rust or more accessible languages like Java or Python.

A company building the latest smart TV, or Fridge, or Japanese-style automated toilet needs to ship their device, fully loaded with working software to control the device, connect to the internet to provide analytics back to HQ and get new versioned updates to introduce new features - or most importantly, to receive security patches.

Cloudsmith provides a distribution toolkit for IoT that helps to solve the issues with global rollout at scale.

If you need fast, reliable deployment infrastructure; look no further. Cloudsmith provides accelerated edge delivery of software to allow you to stay close to the sea of devices you want to manage. And what’s more, the caching of your packages and artifacts at the edge is configurable, because there is no one-size-fits-all solution. Your needs are bespoke, and Cloudsmith gives you the control to define a best-fit solution for your own needs.

Cloudsmith enables you to automate the rollout of software using a unique token to manage repository access for each device. Entitlement tokens are read-only access tokens for a Cloudsmith Repository and they can be created to nearly any secure standard.

You can attach metadata; allowing you to store additional information for the device. You can add restrictions to the token; such as a validity period, a specific allowable device IP address or a maximum number of downloads. Each token can be individually managed and filtered to provide tight control of your IP. All of which is accessible via the Cloudsmith first-class API.

Track and monitor which devices have received the latest update. You can attribute each download from Cloudsmith to the specific Entitlement Token used, and you can see when and from where it was used. You can also export this data for further ingest into your own big data or analytics platform of choice, giving you an unparalleled view over the status of your IoT fleet and their package/updates status.

Cloudsmith repositories are fully multi-tenant for package formats. This means you can store all of the package types that we support in one repository, and this repository still works as a native repo with all of the client-side tooling for each format. No more managing multiple repositories if your IoT devices need 

 and even more. Simplify your package management, and gain more control.

Cloudsmith provides a “low-gravity” launchpad for IoT software updates at scale. Let us worry about performance, delivery and scalability while you concentrate on building secure software your customers will love.

The Internet of Things - Why Cloudsmith Plays a Crucial Role

Cloudsmith provides a way for vendors to sell, license and distribute software as packages. To any customer, anywhere in the world, across a reliable and performant infrastructure, and handling all licensing and invoicing / billing challenges.

As most of the readership of this blog will know, a huge proportion of the software developed around the world is dependent upon the third-party packages and libraries we integrate into our projects.

And whilst a lot of that will be open-source, a surprisingly large amount will be distributed on a commercial basis. Plenty of organizations generate revenue by selling packages and libraries, almost always on a business-to-business (B2B) basis, to clients looking to speed up their own development processes and deliver better software, faster.

Just by way of example, consider the following common use cases:

The creator of fonts, icons or other similar libraries that may be integrated into web projects

Creators and/or distributors of core network libraries

Hardware companies needing to distribute drivers to customers

These organizations have a challenge. They need to sell and distribute the packages they create to customers all over the world, and they need to do so in a way that:

Is easy and inexpensive to support for themselves, and

The rest of this short piece will take a look at why that has been a challenge in the past, and how new approaches mean that distributing software packages on a commercial basis is now a piece of cake (clue: it involves Cloudsmith).

Commercial Package Distribution: A Short History Lesson

For the sake of everyone’s sanity let’s not talk about prehistory: when software was shared on floppy discs, compact discs and other physical media. Instead, let us save a little time and jump ahead to the digital days.

Until pretty recently the standard way to distribute any form of software, or resources that a software developer might use, has been to 

put it up on an FTP server and allow customers to download them from there

There’s only three problems with that. Unfortunately, between them they make the whole process painful for all concerned:

First, ‘dumb’ downloads are hard to integrate. Customers have to extract what they’ve bought and figure out how to get it into their own environment and tooling. That can require plenty of work, and things go wrong, which means calls to support and time and effort on all sides wasted.

Second, it leaves licensing and access control entirely in the hands of the vendor, which is a challenge. It requires figuring out the easiest way to give customers access to the packages they are entitled to (and only those packages), and for the amount of time they are entitled to them.

Last (and most certainly not least) it doesn’t support modern continuous integration and deployment processes that want to access up-to-date packages on demand rather than download once and use from an on-premises repository.

Faced with these challenges, many B2B software vendors took a new approach: 

distribute software and libraries as ‘packages’ from package repositories.

The good news: this involves sharing content, libraries etc as software packages in the specific package format that allows for easy, effectively automated integration into the developer environment.

So for example, if I am a frontend developer working in Javascript, an npm package ‘speaks my language’, integrates directly into my environment and tooling.

Even better, I can connect to package repositories in this way and access them on demand. In other words, whenever a person or process needs them, they can connect and integrate - rather than downloading once and then being responsible for maintaining and updating hundreds or even thousands of packages, dependencies and libraries on-site.

The problem with this approach, however, was equally simple.

 It requires the vendor building and setting up a private repository and sharing access to that repository with clients all over the world.

Modern development processes demand high levels of availability and performance, so that isn’t a trivial undertaking. It leads to significant amounts of resources just being put into managing and maintaining that infrastructure, resources that were hired to build software.

Oh, and you still have to handle all the complexities around licensing and managing granular access to specific packages and assets.

There is another way: let someone else handle the distribution and licensing of commercial software packages and libraries.

What would that service look like? Well, it has to solve the problems we’ve outlined above, so a checklist would look something like this:

Take responsibility for availability and scalability, or in other words ensure that packages are there when clients need them, and that the service scales to meet new requirements automatically.

Deliver high performance - to customers anywhere on the planet. As many packages are integrated into build processes directly from the repository, it is absolutely essential that this happens fast. And in an age of distributed teams and processes, 

not fast in one place, but fast in any place

Handle licensing and access controls. Whilst the repository is effectively private, the service will need to allow customers read-only access to the right packages and confirm license agreements without too much fuss.

Enable the vendor to share packages in multiple languages and formats as required by customers.

That, in four brief points, is what we have built at Cloudsmith to support vendors.

Cloudsmith is ultimately a platform supporting cloud-native, universal and secure public and private repositories. Of course we work with dozens of developer orgs who simply need a single source of truth for the software assets they use every day, and also need to share those assets across distributed teams.

But we also work with vendors sharing assets to clients outside their own organization.

For vendors, using Cloudsmith has a number of advantages, that largely correspond to the benefits of the approach already detailed above:

We already have in place a fast, reliable, content delivery infrastructure that is used to meet any challenge (so far!), and trusted by thousands of businesses all over the world.

We pay particularly close attention to performance. Again, as a tool used by distributed teams and processes: 

. To that end we have production instances in multiple locations around the globe and support configurable edge caching to ensure that a cloud-native distribution network means zero compromise when compared with storing packages on-premises.

We ensure that all needs around licensing and access control are met in an intuitive way for both customer and vendor. Cloudsmith supports entitlement tokens that deliver access to specific packages across specific time periods, for specific numbers of downloads or clients, all generated and shared automatically via the Cloudsmith API. And we give 

 to our clients. Their customers don’t have to become Cloudsmith customers just to access packages!

Lastly, Cloudsmith is universal. It doesn’t matter what you need to distribute in what format, we can almost certainly handle it. So there’s never any need to maintain more than one distribution network.

That isn’t everything of course. We are always working to ensure that our service gets faster, smarter, and more fully-featured. To give a few recent examples:

We provide comprehensive analytics that show who has downloaded what and when, and macro trends in terms of which packages are proving popular (or unpopular).

We integrate with Zapier to support no-code integration with leading payment platforms, automating order processing of assets stored on Cloudsmith.

We support custom domains. From your customer’s perspective, they are always dealing with your business, and connecting to a repository branded in your name.

If you’re a vendor struggling with some of the challenges discussed in this piece, we’d love to talk. We’re pretty sure we can help you!

Managing Commercial Package Distribution: A Better Way

Software development by distributed teams is nothing new. But since 2020, it’s no longer just teams that are globally dispersed, it is the individual team members themselves. Remote working is the new normal. So in this unpredictable, “modern” world we’re in, how do you put together a solution that delivers for every single team member, no matter their location?

How do two (or more) people work together on the same project, if availability times for integration and deployment have different latency due to old thinking, old infrastructure limited due geographic locations. If a package containing a crucial bug fix takes nearly 15 minutes to replicate from San Francisco to London or Tokyo, it severely hampers rapid rollout of fixes - something that could potentially affect the bottom line of your business.

Organizations have been grappling with the challenges that distributed teams present for some time now, and many different tools and services were created to lighten this burden.

Take source control, for example. Organizations were quick to embrace distributed version control systems, and then went one step further when they shifted these to the Cloud. CI/CD build pipelines are no different, having moved from on-prem build servers to - you guessed it - the Cloud.

But these only solve some of the problems that distributed teams face. What about artifacts and package management?

Historically, one solution was to stand up an on-prem package management system, either as an instance in an organizations’ cloud or a physical server. But in the changing landscape now, this isn’t a great fit anymore. How do you ensure secure, performant access for every member of your distributed development teams? What about redundancy, backups, and high availability?

You may need to stand up many instances around the globe, in many regions - dealing with VPNs, replication, clustering, CDNs etc. Pretty quickly, you’ll probably need a full-time administrator, or a dedicated team to manage this. Costs here quickly spiral, both in terms of the infrastructure you need, the licenses for the software, and the dedicated personnel.

As with other components of the software development and delivery process, it's time for package management to move to the Cloud also, just like source control and CI/CD pipelines. You can reduce your total cost of ownership and at the same time, deliver a better solution for your teams. We believe this passionately, so we created Cloudsmith - a universal, web-scale package management system.

A fully distributed platform. Cloudsmith has been architected from the ground up to deliver best-in-class performance no matter where in the world you are. Multi-region, and backed by a global CDN. We have worked extremely hard to build a reliable, performant platform. Our reputation, and that of our customers, depends on it.

A fully managed service. You don’t need to be an administrator of the platform, it’s all fully managed for you, 24/7. One of our customers put it very succinctly when they switched to Cloudsmith: “We don’t want to be Sys Admins”. We are also here to provide support anytime you need it; our engineering team works closely with our customers to ensure that they get the very best possible value from Cloudsmith.

Secure by default. One of our core principles is security; you could almost say we are obsessive about it: fine-grained access controls, multi-factor authentication, event and access logs, and an extensive permission system. We are proud to say that we have never failed a security assessment by one of our customers.

Universality. With support for 24 package formats at present, and more being added all the time, you can simplify and centralize your package management. Also, with our multi-format repos, you can add all your package formats into the same repos; there are no restrictions on how you structure your repos.

Distributed teams aren't new, but for the post-2020 world, their automated workflows need to be much better for their distributed team members. A fully cloud-native package management solution is now an essential component for modern workflows.

Missing Infrastructure: Accelerated Worldwide Delivery

It’s finally happened. After months of whispers, JFrog have announced the sunsetting date for Bintray - their distribution add-on to their long-standing on-premises Artifactory product. Bintray officially 



JFrog Bintray is a cloud platform that previously let users publish, store, promote, and distribute software.

So what does that mean for Bintray users? In short, users can no longer use the Bintray service and are instead redirected to Jcenter.

Fortunately, Cloudsmith is a direct replacement for JFrog Bintray. And Artifactory. And their X-Ray product.

Don’t get us wrong - JFrog has achieved a lot over the years and we would never publicly speak out against them. They are the distinguished competition, and we respect their accomplishments.

Today, more than ever before, our world became distributed. Teams of developers started working together remotely. Each person needs new ways to communicate and collaborate, and be able to replicate working environments in real-time. It’s no longer acceptable to have everyone in, or physically near, your company headquarters bask in the warm embrace of low latency downloads, while other geographically distributed teams have to put up with significant replication lag.

Cloudsmith was architected and built from the ground up, to solve this exact problem. From day one, our thesis was that package management and software distribution are the same things.

In a cloud-enabled world, there is no distinction when delivering artifacts. It just has to be:

A web-scale, collaborative platform, with security, redundancy and dependability built-in.

Backed by global infrastructure, you’ll get the same amazing experience in San Francisco, as you do in London, Sydney, or Tokyo.

We can see the competition repositioning themselves, to build towards where we are right now - where we started, and where we’ve been for years. And that’s good for you. It’s great for you. Two major league products going toe-to-toe in the market. That means more innovation from both companies and better products for engineers worldwide.

Packages and containers are the fundamental building block of software. Continuous Packaging is the glue between Continuous Integration and Continuous Deployment, providing much-needed visibility and control to secure the pipeline end-to-end. Providing provenance of all artifacts, and an essential isolation layer away from public upstreams.

We are confident that today, and tomorrow, we have the best solution to package management and the vision of how to solve the inherent challenges with building secure supply chains. Security not just at the left, but all the way through the pipeline.

Cloudsmith provides secure storage and lightning-fast Edge distribution backed by intelligent infrastructure. It's not just a backend with a CDN - it's so much more than that. It’s a Package Delivery Network.

Alan Carson

Co-founder and Chief Strategy Officer

Cloudsmith, the JFrog Bintray Alternative & Replacement

Entitlement Tokens

A walkthrough of Entitlement Tokens; how to create, restrict, and permission with the use of tokens using a Maven example.

 Cloudsmith released Phase II of our API+CLI which gives users greater control over package handling including search, entitlements and package actions. We're very excited by the additional possibilities of automation and integration that these introduce. If we're helping you automate, we're doing our job right.

Balancing the quest for automating everything with a sublime user-experience is never an easy thing, but we've found that if there's one thing that users love, it is FOPS - an affectionate term that we use for 

 functionality, and the releases this month are delivering it in spades.

Note: To take advantage of the API/CLI features in this newsletter you'll need to upgrade your CLI to the latest version (0.5.5 or above), which you can easily do via pip:

You can now list, create, update, delete, refresh and sync entitlements and their tokens via the API and the CLI.

A hugely requested feature is the ability to manage entitlements for a repository via the API and the CLI, and the following is now possible to do so:

List entitlements in a repository (tokens can be hidden/shown).

Create new entitlements for a repository.

Delete existing entitlements from a repository.

Cloudsmith Blog