By submitting this form, you agree to our 

Choosing the right software package for your project can sometimes feel like finding a needle in a haystack. Package registries do a great job at being comprehensive, but they can’t necessarily guide you to the best package for your project. What is a “high quality” package anyway? This is a problem the OSS community 

We’re proud to announce the full public release of 

. Navigator is designed to help software engineering teams select the highest quality packages early in their development lifecycle. Navigator integrates and analyses data on 

40,000 of the most popular open source packages 

across NPM, PyPi, RubyGems and Maven, assigning each one a unique quality score based on adherence to security standards, good maintenance metrics, and thorough documentation.

Like most software engineering teams, we regularly look for software packages to help us get our work done. Finding and selecting the right open source package for a project is not straightforward. It's a balancing act. You need to find something that helps you get the job done, but often a package's functionality is just the starting point.

Many packages accomplish similar objectives. Some are more secure than others. Some have better documentation than others. Some are new to the ecosystem, while others are tried and tested.

 We regularly wonder what constitutes a high quality package, and this is something that has been a source of discussion and debate for as long as open source software has existed.

?” then it backs it up with detailed information.

 It cuts through noise for engineering teams. We have developed our own unique perspective on what constitutes a great package. We have expressed this in three essential metrics:

. This is where you'll find information about the essential security and community uptake of a package. If a package has no open CVE's, good test coverage, current dependencies, and is widely used in the open source community- it’s likely to score highly on Navigator’s quality metric.

The next metric is designed to capture a package's 

. A package will score highly if it is regularly maintained by a wide pool of contributors, underpinned by a code of conduct.

The final metric in our Navigator scorecard describes a package's 

. There is nothing mysterious here, we score packages highly where they have a Readme, a documentation website, and a changelog.

 can analyse the quality of package dependencies. 

If a package looks good on the surface, you really should try to understand what packages it relies on at Runtime and Buildtime. Navigator analyses these dependencies where possible, so it's never been easier to understand the trade-offs involved in consuming an OSS package.

For the first time, we as a team have somewhere to go where we can quickly assess package quality. It's no longer a scavenger hunt. We no longer need to overinterpret the number of stars a package has on GitHub, or trawl through multiple sources of information, just to understand if a package is documented, or currently maintained.

We think this is something that all software engineering teams will use, so we’re making it available to the community. After an initial beta in late 2023, we're happy to announce that 

Over time, we’ll add many more packages, and enhance quality scores to include real-world usage data, something that is only possible with Cloudsmith. Thanks to our cloud architecture - we have a unique understanding of the way software is built today. We’re excited to incorporate some of our unique insights into future versions of 

Paul May

Senior Director, Product & Customer Experience

Cloudsmith Navigator: The Trusted Guide to OSS Package Quality

Observability is emerging as critical DevOps practice to predict, prevent, identify, and address issues in the distributed, dynamic, complex, and constantly evolving applications and infrastructures that characterize modern software systems. Wisely, many teams are adopting observability tools like Datadog, Elastic, and AWS Athena to aggregate logs from their build tooling and better visualize and understand the state of their entire system.

But, observability tools are only as good as the logs they consume.

A high-caliber artifact management solution should be a rich, central source of information about your software supply chain; after all, it hosts your software and your dependencies. This is why we invest heavily in the quality of Cloudsmith’s logs and make sure they’re easy for you to extract your logs and integrate into your observability tools.

Sharpening your vision with Cloudsmith logs

Our logs give you granular visibility into your entire lifecycle of artifacts, user interactions, and system behavior so you can proactively monitor, debug, and optimize your software supply chain and operations. We provide these three main types of logs:

Reduce risk and react faster with audit logs

 audit logs are essential for robust cybersecurity and compliance strategies. Organizational audit logs capture events across your organization, including the creation and deletion of repositories and modifications to settings.

Repository audit logs offer a timeline of non-package actions within a repo (typically administrative activities), like modifying retention rules or creating an entitlement token.

Together, they offer a comprehensive view, and analyzing these detailed records can be extremely useful for the following:

Identify and respond to unauthorized access attempts or suspicious activities in the audit logs.

Trigger alerts for any unusual patterns or anomalies in user activities that indicate a potential security threat.

Track changes in repository settings or retention rules to ensure compliance with organizational policies.

Monitor and audit user actions to meet compliance requirements and regulatory standards.

Investigate and troubleshoot specific issues reported by users or identified through audit logs.

Utilize historical audit logs to trace changes and events leading up to an issue and rectify it quickly.

Identify and resolve issues promptly by reviewing audit logs for any operational discrepancies or errors.

Use audit logs to track repository creation/deletion and help in capacity planning.

Improve OpEx and product planning with client logs

 help you understand how your builds are being consumed by providing a record of every package downloaded by your users, along with information such as date and time, user agent, and IP address.

You can leverage these logs to improve product and operational decisions, for example:

Analyze client logs to understand how packages are being consumed to help you optimize infrastructure and resource allocation.

Monitor package downloads and associated bandwidth usage.

Implement alerts based on download thresholds to proactively manage and optimize cloud costs.

Analyze download trends to align resource provisioning with actual usage, preventing unnecessary expenditure and optimizing your cloud bill.

Use client logs to identify popular packages, enabling prioritization in product development efforts.

Analyze download trends by country and usage by package versions to inform feature improvements.

Anticipate capacity changes with package logs

 provide a detailed record of all package-related events within a repository.

These include unique event IDs, package IDs, event types, dates/times, user IP addresses, and user account details, and they’re useful for:

Analyze package logs to understand resource utilization trends and plan infrastructure scaling accordingly.

 Identify patterns in package downloads, helping you understand peak usage times and plan for increased capacity during high-demand periods.

 Analyze user locations from IP addresses, allowing you to anticipate regional variations in demand and optimize resources accordingly.

 Identify frequently downloaded packages, enabling proactive scaling for high-demand software.

Compatible for convenient extraction and analysis

You can view all of our logs in your Cloudsmith UI, and we provide help documentation for our

. But you can also easily export and integrate them with your observability tools.

access real-time audit logs via the Cloudsmith API for your 

Most observability tools can consume logs from an AWS S3 bucket, either by ingesting data from custom RESTful API or through integrations.

Datadog is a cloud-based monitoring and analytics platform that can 

, providing insights into system performance. The 

, ingests audit logs information, incorporates other status details from Cloudsmith, and displays them on a Datadog dashboard.

Part of the Elastic Stack, Elasticsearch is a distributed search and analytics engine that can 

 consumed from an S3 bucket. Alternatively, 

can be used for collecting custom HTTPJSON events

Splunk is a widely-used platform for searching, monitoring, and analyzing machine-generated data, including logs. You can 

use Splunk to ingest Cloudsmith logs from the AWS S3 bucket

A serverless query service, Amazon Athena allows you to analyze data directly in an Amazon S3 bucket using standard SQL. We have documentation on 

how to use AWS Athena to extract insights from our Client logs

Cloudsmith logs are crucial for enhancing security, compliance, and operational efficiency in your software supply chain. 

 to empower your organization with actionable insights. Or 

 with any questions. We’re more than happy to help.

Ciara Carey

Solutions Engineer

Improving Observability With Cloudsmith Logs

One of our core motivations in building Cloudsmith is to make software developers' lives easier. We want Cloudsmith to be one of those great products that feels intuitive and automates everything.

As we’re picking up more and larger customers, we’re seeing an increased need for migration tools. We want to make it as easy as possible for teams who are stuck using JFrog Artifactory, or Sonatype Nexus, or other legacy tools to move over to the joy of SaaS artifact management using Cloudsmith.

In theory, anyone can migrate their own repos and data to Cloudsmith, using our APIs, CLI, and webhooks. But we really want to make this 

So, we’ve established a new team at Cloudsmith called 

. The mission of Customer Engineering is to build migration and integration tools that extend Cloudsmith. This will include migration tools, GitHub Actions, and extensions to our Terraform provider.

We want to let the Cloudsmith community contribute to and extend the tools we build, so we’re going to make all the source code available in GitHub and invite anyone to make improvements, submit pull requests, and take these tools wherever they need to go.

Our first project is a Cloudsmith Migration Toolkit. The Toolkit provides repository structure mappings, upstream/remote source configurations, and ETL-style data migration, specifically targeted at teams migrating off JFrog Artifactory. The Toolkit will securely create your Cloudsmith repos, let you decide which Artifactory repos you want to migrate, transfer artifacts, and preserve metadata and versioning.

If you are interested in trying out the Toolkit, 

 (we just need your name + email address), and the Customer Success team will be in touch.

Nick Peacock

VP, Customer Success

Coming Soon: Cloudsmith Migration Toolkit

Your software artifacts are your intellectual property; that’s why Cloudsmith is built to put you in control. Cloudsmith provides a flexible, powerful permissions system and 

 to control authentication, team membership and manage your users' lifecycle.

Managing users across hundreds of applications and systems can be a painful process, though. And we want Cloudsmith to be the artifact management platform of choice for enterprise customers. So we are pleased to let you know that we are expanding on the System for Cross-domain Identity Management (SCIM) capabilities in Cloudsmith. By integrating Cloudsmith with your identity provider (IdP) via SCIM, you can automate provisioning and de-provisioning users in Cloudsmith, letting your IdP serve as your single point for managing user access in Cloudsmith.

What is the System for Cross-domain Identity Management (SCIM)?

SCIM, or System for Cross-domain Identity Management

, is an open standard designed to manage user identity information. SCIM communicates user identity data between IdPs such as 

, and service providers requiring user identity information (such as enterprise SaaS apps, like Cloudsmith). SCIM uses RESTful APIs to transfer user data between systems.

SAML is primarily used for single sign-on (SSO) authentication between applications and systems. SAML enables users to log in once to a single system, proving they are who they say they are, and then access multiple other systems without having to log in again.

Where SCIM differs is that it is API-based, not login-based. When changes to identities are made in the IdP, including create, update, and delete, they are automatically synced to the service providers (like Cloudsmith) according to the SCIM protocol. For end users, this means that they have seamless access to applications for which they’re assigned, with up-to-date profiles and permissions.

Get Early Access to SCIM on Cloudsmith Now

To demonstrate our commitment to providing enterprises with the control they need, we are offering early access to SCIM provisioning and de-provisioning capabilities. By participating in the early access program, you get an exclusive opportunity to explore these capabilities firsthand and shape the final release with your feedback.

To sign up for early access, please reach out to 

. We look forward to partnering with your enterprise on this journey of enhanced control and efficiency.

Thank you for choosing Cloudsmith as your trusted platform. Stay tuned for more updates as we continue to empower enterprises with cloud-native artifact management.

Alison Sickelka

VP of Product

Take control of user management with Cloudsmith's new SCIM capabilities

As the "new guy" here at Cloudsmith (I was named CEO in August), I'm learning more every day about how customers use us to protect their software supply chains. We're doing everything we can to give you a single source of truth for every artifact - whether it's an open source package, a Docker container, a Linux image - that enters your software supply chain, and everything that you produce on the other side.

Turns out this is a massive challenge for most software organizations. When developers pull packages from public indexes like npm, pypi, Maven Central, or NuGet, they may be introducing known vulnerabilities into builds, or using code that's no longer actively maintained. It's hard to track and control what's coming in, and what's been permitted to be deployed to your production systems. The bad guys have discovered that the software supply chain has soft spots that can be used to introduce malware.

Cloudsmithers are dedicated to helping DevOps teams manage this end-to-end flow. Our flagship product, Cloudsmith, made great strides in 2023 towards providing a comprehensive solution that lets you keep an eye on every bit & byte that comes in or goes out. Here's a little visual summary of all we've achieved together in 2023:

, meaning that we'll automatically pull and scan these artifacts from public sources when they're available, so you don't have to manually load them into your Cloudsmith repositories

 by optimizing how we handle Docker layer de-duplication

 to give you more options to automate your pipelines

 to help you find the best packages for your project

And we did it all while maintaining a 97.5% customer support satisfaction score!

And we're just getting started. 2024 will be an even bigger year for Cloudsmith and our ecosystem. We saw a 48% increase this year in overall package download volumes, so we know how much you're counting on Cloudsmith to keep your builds safe and performant. So we promise our customers that we'll deliver more features and support that you need to take control of your software supply chains.

THANK YOU CLOUDSMITH CUSTOMERS!! Tell me how we're doing, or what you need from us in 2024 - 

And if you want to try out Cloudsmith, play around with your personal dev projects to get a feel for how it works, or use us to manage and distribute your open source project - get started at 

. (It's free for up to 0.5GB of storage and 1GB of bandwidth per month for personal use, or 

50GB of storage and 200GB of bandwidth for open-source projects

Glenn Weinstein

How Cloudsmith Helped Protect the Software Supply Chain in 2023

Adoption of the EU Cyber Resilience Act is coming in 2024. This means that if you make software or hardware that’s sold in the EU and don’t fall within one of Act’s four product exemption categories, you’ll soon be legally required to comply with the Act’s requirements or risk penalties.

If you’re not using a modern package management system as part of your CI/CD process, you may find it harder and more time-consuming than others to meet the compliance requirements—particularly the requirements to minimize vulnerabilities and be transparent with consumers about the cybersecurity aspects of your products. (Read our post 

How To Comply With the EU Cyber Resilience Act

 for full details on compliance requirements.)

For instance, dated, legacy systems often:

offer limited visibility, which could make it challenging to identify and address vulnerabilities in the timeframes required by the CRA;

may not include automatic scanning tools for identifying vulnerabilities in dependencies, leaving teams to handle this manually—which is a time drain and introduces human error;

can struggle to manage track, and analyze the complex dependencies that are characteristic of modern software development; and

lack robust logging, audits, and reporting, making it harder and more time-consuming to assess, prioritize, and respond to software security issues.

In contrast, modern cloud-native artifact management systems, like 

, are built by design to secure software development across the entire software lifecycle—from pull-down to distribution—streamlining your team’s CRA compliance efforts through the benefit of:

Specifically, we can help you achieve the standards set out by the new CRA with our 

We’ll continue to create features in Cloudsmith that support our customers as the Regulation’s requirements evolve.

Want to know more about how Cloudsmith can support your CRA compliance efforts? Start your free trial now or talk to sales today.

Simplify CRA Compliance With Modern Tooling

This week, the European Union (EU) reached an agreement on the 

Set for adoption in 2024, the CRA aims to protect consumers from insecure digital products, introducing mandatory cybersecurity measures such as vulnerability disclosure, Software Bill of Materials (SBOMs), and security updates throughout the product life cycle.

The CRA covers a wide range of digital products, from operating systems to baby monitors. Companies affected by this Act have 36 months to comply, facing penalties of up to €15 million or 2.5% of global turnover for non-compliance.

While most digital products may self-regulate, some, like Firewalls, Operating Systems, or Smart Meters, face more stringent cybersecurity requirements.

Despite the welcome, the CRA sparked concerns, especially in the Open Source Software (OSS) community, fearing inadequate exemptions and burdensome vulnerability reporting. The final version addressed some worries by extending exemptions to non-profit OSS organizations. Additional criticisms focus on potential disadvantages for EU businesses and uncertainties regarding auditing and funding.

The CRA introduces the following requirements for digital products sold in the EU:

Manufacturers must provide consumers with timely security updates for several years after purchase. The support period is designed to align with the expected lifespan of the products.

Manufacturers must disclose and patch vulnerabilities promptly and without charge. Manufacturers that discover a vulnerability in an OSS dependency will be required to notify the maintainer.

Manufacturers must report actively exploited vulnerabilities within 24 hours to both the competent Computer Security Incident Response Team (CSIRT) and The European Union Agency for Cybersecurity (ENISA) through a unified reporting platform. There are some narrow conditions where ENISA does not need to be informed, but they must receive adequate information to monitor systemic risks.

Manufacturers must include a SBOM in a common format, detailing at least top-level dependencies. Manufacturers must provide the SBOM to both ENISA and market surveillance authorities.

Member States will designate market surveillance authorities to enforce the EU Cyber Resilience Act. If a product is non-compliant, these authorities can:

Manufacturers can face fines of up to €15 million or 2.5% of their total worldwide annual turnover for non-compliance with essential cybersecurity requirements under the Cyber Resilience Act. For other obligations, fines can reach €10 million or 2% of the total annual turnover.

Products meeting the CRA’s essential requirements will receive the 

, signifying compliance with the Act's cybersecurity standards.

This marking is necessary to place your product on the market within the European Union.

The Regulation applies “all products with digital elements whose intended and reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network.”
That’s a lot of products!

Most products are likely to self-regulate and apply the CE mark. However, the CRA specifies two categories of ‘critical products’ that are subject to more stringent requirements due to their higher perceived risk. These are divided into class I and class II, with class II products representing a greater risk. Manufacturers of class II products must involve a third party in their compliance assessment process.

These products are vital to the functioning of critical services and entities. Examples of Class I products include:

firewalls, intrusion detection/prevention systems;

industrial automation and control systems (IACS);

security information and event management (SIEM) systems; and

Class II are considered by the CRA to have a somewhat higher level of criticality compared to Class I. Examples of Class II products include:

operating systems for servers, desktops, and mobile devices;

hypervisors and container runtime systems;

public key infrastructure and digital certificate issuers;

secure elements, hardware security modules (HSMs);

smartcards, smartcard readers, and tokens;

robot sensing and actuator components; and

Not every digital product must comply with the new Regulation. Here are the exceptions.

The EU Cyber Resilience Act does not apply to Software-as-a-Service (SaaS) products.

Earlier drafts of the Act had an exemption for OSS individuals, but there was a gray area. It was unclear whether OSS organizations and contributions that could be deemed commercial would be exempt.

The final draft of the CRA now exempts free and open-source software developed or supplied without commercial intent. Notably, non-profit organizations selling OSS but reinvesting revenues in non-profit activities are also excluded. This exclusion protects the open-source community from unnecessary regulatory burdens.

The proposed Regulation won't cover products with digital elements already regulated by specific laws, such as:

medical devices (Regulation EU 2017/745 and EU 2017/746)

products certified under aviation safety (Regulation 2018/1139)

motor vehicle products (Regulation EU 2019/2144).

Products developed or modified exclusively for national security or defense purposes are excluded from the scope of the regulation.

The EU Cyber Resilience Act represents a significant stride in strengthening digital security across the EU.

By setting clear standards for cybersecurity, the EU aims to empower consumers, build trust in digital products, and establish itself as a global leader in cyber resilience.

Will the CRA get the balance right between security and innovation? Will it suppress the use of OSS? Will it be overly burdensome for businesses, especially SMEs? Only when the Act is being implemented will we see the true impact on cybersecurity, innovation, and the broader digital landscape.

Simplify CRA compliance with the help of modern tooling

How to comply with the EU Cyber Resilience Act

? The act is an EU regulation that aims to tackle low cyber security levels and make it easier for consumers to identify and choose secure digital products. First announced in the 2020 EU Cybersecurity Strategy, it’s the cyber security equivalent of GDPR and complements other cyber security legislation, like the NIS2 Directive.

The Act (also referred to as the CRA) applies to the vast majority of digital products sold in the EU—from operating systems to baby monitors—and when it comes into force in 2024, affected companies will have 36 months to adapt to the new requirements and become compliant.

At the minute, many digital products lack robust security measures and it’s often impossible for ordinary consumers to assess the security of those products. The CRA addresses this by introducing:

mandatory cyber security requirements for hardware and software products; and

 on products to signify they’re compliant.

Requirements include vulnerability handling, security updates, 

, and reporting actively exploited vulnerabilities within 24 hours of becoming aware of them. By mandating these measures throughout the product lifecycle, the Act aims to:

 Products entering the EU market must not have significant vulnerabilities that can be hacked.

 Manufacturers must provide clear and transparent information to consumers on the cyber security of their products. This includes secure default configurations, protection mechanisms against unauthorized access, and encryption of sensitive data.

 A key aspect of the CRA is the legal requirement for manufacturers to provide security updates for a defined period after purchase, reflecting the expected product lifespan.

The majority of digital products are likely to be self-regulated, but some products—like firewalls, SIEMs, operating systems, and smart meters—are held to more stringent cyber security requirements, including a third-party audit.

The open-source community has raised concerns about the Act, fearing its vulnerability reporting burdens. However, its final version does extend exemptions to non-profit OSS organizations. Other criticisms include potential disadvantages for EU businesses and uncertainties surrounding auditing and funding.

Will your product be affected by the CRA? If so, find out 

how to comply with the EU Cyber Resilience Act

Need to get a jump on CRA? Find out how to 

simplify CRA compliance with the help of modern tooling

What is the EU Cyber Resilience Act?

This week, we announced that Cloudsmith has taken an impressive $11M in additional funding, hot on the heels of our $15M Series A two years ago. That's not just serious cash for a startup; it's a game-changer! The natural questions are: why did we take it, and what's our big-picture plan?

Here's the why: Cloudsmith isn't just a proven, enterprise-class artifact management platform; we're a market disruptor. We've consistently outperformed and replaced legacy products like JFrog's Artifactory and Sonatype's Nexus, becoming the go-to choice for large organizations with hundreds of developers. We're not just playing in the big leagues; we're setting the pace.

I've seen this movie before. A SaaS upstart challenges a market burdened by outdated, on-premise software. And SaaS inevitably wins out. It's not a matter of if but when. Companies don't switch off systems like JFrog on a whim, but when they realize it's time to refresh, they will look for something authentic, fresh, and modern. That's Cloudsmith.

We're driven by a sense of urgency to ensure Cloudsmith not just competes but dominates these market takeovers. This means offering a comprehensive, unmatched feature set and amplifying our presence with bold sales and marketing. We're not just waiting to be noticed; we're making sure we're the obvious choice, especially for customers upgrading from JFrog or Sonatype.

And here's the plan: we did a leadership exercise to craft a strategy to turbocharge our growth. It's about scaling up significantly in a few critical areas.

A powerhouse engineering team to enhance package format support, innovate, and develop next-gen products and features.

Cloudsmith Blog

Cloudsmith Navigator: The Trusted Guide to OSS Package Quality

Improving Observability With Cloudsmith Logs

Coming Soon: Cloudsmith Migration Toolkit

Take control of user management with Cloudsmith's new SCIM capabilities

How Cloudsmith Helped Protect the Software Supply Chain in 2023

Simplify CRA Compliance With Modern Tooling

How to comply with the EU Cyber Resilience Act

What is the EU Cyber Resilience Act?

You Took HOW Much Money?!?

Secure Open Source Consumption: Level 1 of S2C2F

Why Developers Need a C++ Package Manager

Mastering Open Source Security: Your Guide to S2C2F