By submitting this form, you agree to our 

Answer twenty questions about your artifact and supply chain practices. Get a custom report card showing your maturity score against key regulatory and compliance frameworks.

Artifact Security Maturity Assessment

Optimized for distributed teams working at any scale, Cloudsmith is your single source of truth for software assets. Proxy and cache to public upstreams, and use our Zero Trust model to control access to your most valuable IP. We’ve spent years creating the industry’s only true cloud-native solution to global software distribution at any scale. Let’s get you shipping without friction!

Booking a meeting with the Cloudsmith Team

You can find the Cloudsmith team in the sponsor showcase at booth K6 across from meal break seating, Wednesday - Friday. Stop by and see us to:

Speak with our experts about fully managed, scalable artifact management

Learn how your team can cut costs, speed up production, safeguard your code, and boost productivity

Catch a demo from an expert anytime, just stop by!

Take home some epic swag! We're bringing limited edition stainless mugs and beanie caps for your next mountain adventure!

Grab a limited edition "SLC 2024" Lego brick

We've partnered with Chainguard, Docker, Github, Sysdig + Tailscale to give away some epic prizes! Grab a "lift ticket" from any partner booth and collect your stamps before the end of KubeCon for your chance to win:

Kick-off KubeCon on Tuesday with us at the House of Kube!

Cloudsmith is proud to sponsor the (un)official opening party everyone talks about, House of Kube! Reach out to events@cloudsmith.com to request a ticket if the event is sold out. 

Cloudsmith is proud to partner with Chainguard, Docker, GitHub, Sysdig and Tailscale to bring you THE party after-KubeCon, AprésKube! Hang out and connect with DevOps, DevSecOps, Cloud, and Open Source professionals from communities around the world at Gracie's in Salt Lake City. Reach out to events@cloudsmith.com to request a ticket if the event is sold out. 

Lee Skillen

Chief Technology Officer

Cloudsmith is headed to Salt Lake City for KubeCon North America 2024

Package promotion workflows are a great way to isolate and protect production repositories, allowing progressive levels of security and permissiveness for development, staging, and production environments.

Once a binary is uploaded to Cloudsmith, it can move from development -> staging -> production, maintaining the integrity of the asset and its provenance trail. This migration takes place entirely within Cloudsmith; there’s no package delivery cost.

The differences between Dev, Staging and Production environments.

Cloudsmith's package promotion instructions- package copy/move actions

Complementary features that play nicely with package promotion, including webhooks, quarantining, policy management and upstreaming. These can be used together to create workflows and drive actions.

A Potential workflow for package promotion

Policy management that lets you set up policies that serve as prerequisites to package promotion.

Differences between Dev, Staging, and production environments

Typical software development organizations maintain three types of environments: development, stage, and production.

environment is used for developers early in the software process to see how new features will work, to try out improvements and pull in new dependencies or update existing dependencies.

 environment is used for testing integration and is a production-

environment that allows user creation without impacting production data. Only whitelisted IPs typically have access to Staging.

 environment is what end users are using on a live system.

Cloudsmith's package promotion workflows are powered by features to copy and move packages between repositories, usually for promoting immutable versions of packages between separate build, test, staging and production pipelines. The package that was verified in build is the same package in production when it gets promoted to there. Cloudsmith facilitates the automation of copying and moving packages using our command line interface (CLI).

 for vulnerabilities and license issues. This ensures that only secure and compliant artifacts are promoted through the pipeline, with policies applied to block or quarantine packages that fail these checks.

Let's see an example of moving a package in action:

 package was moved (or "promoted") from the source repository to the destination repository. Copying packages works the same, except it duplicates the package rather than moving it from the source to the destination.

In addition to moving and copying packages, you can also resync packages via the CLI, whereby the CLI will retry packages that have failed (for whatever reason) up to a configurable amount of attempts.

To see the full list of help for actions, run the following commands:

Package promotion on its own is great, and you can couple it with other features to create workflows and drive actions. Let's talk about tagging, webhooks, multiformat repos, vulnerability scanning, and setting up upstream.

 feature allows you to label your packages with tags like "dev", "staging", or "prod" as they move through your pipeline. These tags help in tracking packages across different environments, and enable targeted searches, filtering, and control over what artifacts are accessible. By using 

, you can automate package promotions based on tag transitions, such as promoting a "staging" package to "prod" once it passes certain tests). This enhances visibility and governance within your pipeline and simplifies the overall package management process.

Webhooks let apps send automated messages or information to other apps. 

 are great for integrating Cloudsmith with other systems in your build pipeline, by sending data or notifications to other tools in your stack and helping to enable automation across your workflows.

Cloudsmith has webhooks for vulnerability scanning. Anytime a scan is completed, Cloudsmith can dispatch a corresponding vulnerability webhook to trigger some action, like creating a Jira ticket.

Cloudsmith's vulnerability scanning is particularly effective when combined with upstreams. Upstream proxying and caching allow you to upload and use the packages you author in-house directly, while Cloudsmith fetches and caches your dependencies from public repositories like Maven Central or NuGet.org.

This enables you to use Cloudsmith as a first-class cache and a central source of truth for packages, to protect you from issues related to use of external services, such as downtime, rate limiting, or non-availability of a previously available package.

Packages fetched from a caching-enabled upstream will be automatically scanned for vulnerabilities for Ultra customers.

Multi-format repositories allow you to store artifacts of different formats in the same place. Organize your packages by environment, project, package type, or whatever way you see fit.

Package vulnerability scanning is a key step in securing your software delivery pipeline and reducing the risk of releasing insecure software into production.

Cloudsmith automatically scans every supported package format pushed to a Cloudsmith repository or fetched from a caching-enabled upstream.

Cloudsmith's vulnerability scanning feature is available for the following package formats:

Cloudsmith's Security Scanning page shows a breakdown of the number of packages scanned/not scanned, the age of scans, the pass/fail count overall and the maximum severity of those found.

Setup your Dev repository with upstreams and your Staging repos with no upstream

Push your package to Dev repository and tag the package with ‘dev’.

Automatically tag the package with ‘staging’ and move the package to the Staging repository when the results return with no vulnerabilities.NOTE: you may want to run more manual tests against this package before promoting it.

 for the examples below. The CLI interfaces with Cloudsmith's API and allows users, machines and other services to access and integrate smoothly with Cloudsmith without requiring explicit plugins or tools.

Setup your Dev repository with upstreams and your Staging repository with no upstreams

Create 2 repositories Dev and Staging by following the instructions 

.

Set up an upstream for the Dev repo by following the instructions 

A vulnerability scan is automatically triggered for supported packages every time they are pushed into a Cloudsmith repository. If you set up an upstream, your 3rd party dependencies are also scanned for vulnerabilities.

Cloudsmith supports over 30 different types of packages. 

Upload via the package-specific native CLI / tools e.g. using Maven's 

Upload via the API using tools/integrations (such as the official Cloudsmith CLI).

To upload a package via the Cloudsmith CLI, use the cloudsmith push command:

Setting up webhooks so Cloudsmith can send automated messages to alert another system when a package had been scanned is great for setting up vulnerability workflows.

 in your repository and then create a new webhook. Then:

 with the tool you want to receive your webhook like 

You can test out the Webhook by selecting to 

The webhook is triggered when the scan is finished and will have a payload in the HTTP req with information about the package and any vulnerabilities, including:

This information can drive actions such as tagging and promoting a package based on the maximum severity reported.

, use the command cloudsmith tag as follows:

cloudsmith tag add OWNER/REPOSITORY/PACKAGE TAG1, TAG2

 promote a package use the Cloudsmith CLI command cloudsmith cp or mv as follows:

For example, using the data from the snippet above where 

 is the package identifier or the package 

cloudsmith cp demo/examples-repo/IB6FYhIvaoAy

Enhance your Workflows with Policy Management

To further secure and streamline your package promotion workflows, Cloudsmith’s 

 features can be used to automate and enforce critical security measures. With 

, you can automatically block or quarantine packages that violate license rules, while 

 scan for potential risks, quarantining packages based on severity. 

 enforce API-key rotation to ensure secure access.

These policies make your workflows more secure, compliant, and automated—minimizing manual intervention and reducing risk across your software supply chain. To explore these features in more detail, check out our blog on 

Looking ahead, Cloudsmith’s Enterprise Policy Manager will further enhance promotion workflows with advanced controls.

 It will allow policies to be applied at any decision point, ensuring real-time enforcement of security and compliance rules like “should we allow this action?”
Key features include:

: Create custom policies tailored to your specific needs, from access control to package promotion.

: Manage and trace policies at scale for better compliance.

: Integrate data like Cloudsmith Navigator and security scanners for more informed decisions.

: Speed up implementation with best-practice policy templates.

: Leverage your existing security tools within Cloudsmith.

Ciara Carey

Solutions Engineer

How to Manage Your Package Promotion Workflows with Cloudsmith

Managing modules/packages, whether hosted privately or sourced from public registries, presents challenges such as security vulnerabilities, lack of visibility into package usage, and dependency on the availability of public registries.

 directly addresses these issues, offering secure, controlled, and efficient package management for both private in-house modules and public npm packages.

How to use Deno and Cloudsmith for 2 different use cases:

Modules sourced from npm but proxied and cached in Cloudsmith.

 is a complete, “batteries included”, JavaScript and TypeScript toolchain, which includes a runtime, 

, and more. Deno addresses the shortcomings and 

 of Node by making it more simple and secure. It includes 

Integrating Cloudsmith with Deno offers a powerful solution for managing npm packages, whether they are private or sourced from public registries. Here's why Cloudsmith is the ideal partner for your Deno projects:

Deno’s security-first architecture pairs perfectly with Cloudsmith’s private npm registries, ensuring only authorized users can access your npm packages.

: Deno’s modern runtime makes it easy to manage dependencies, but visibility into them is crucial. Cloudsmith provides full transparency into all packages used in your Deno projects, whether stored privately or proxied from npm. This visibility lets you easily track, audit, and manage all dependencies, helping you maintain a secure and reliable codebase.

: Cloudsmith will verify every npm package in your Deno project by automatically scanning it for security and compliance threats.

: Leverage Cloudsmith’s caching to speed up builds and ensure that your Deno projects are not dependent on the availability of public registries.

By leveraging these benefits, Cloudsmith enhances your ability to manage and secure your software supply chain, leading to faster development cycles, more reliable deployments, and greater peace of mind.

Use Case 1: Managing a Private In-House Module with Cloudsmith

When working on sensitive projects or proprietary software, ensuring that your npm modules are private and secure is crucial. Here’s how to manage these private modules using Cloudsmith with Deno.

Let’s start by showing you how to use a private npm module stored on Cloudsmith in a Deno project.

Step 1: Set Up Your Cloudsmith Repository

creating a private repository in Cloudsmith

 to store your npm modules. Cloudsmith’s repositories are 

, meaning you can store packages of different formats (e.g., npm, Docker, Maven) in the same repository.

Step 2: Create and Publish Your npm Module

. For example, if you have a module called my-fave-npm-package, you would publish it using npm:

Step 3: Configure Deno to Use Your Private npm Registry

In your Deno project, create a .npmrc file to point to your Cloudsmith repository and manage authentication:

Replace YOUR_TOKEN_HERE with your Cloudsmith API key or your 

Next, configure your deno.json file to import your private module

configure your deno.json file to import your private module

 file, you can now import and use the private module:

This setup ensures your project securely fetches the private npm package from Cloudsmith.

Use case 2: Using Cloudsmith’s Upstreams.

Setting up an upstream proxy to npm through Cloudsmith is essential for organizations that prioritize security and control in their development processes.

Using Cloudsmith’s upstream capabilities, you can pull your dependencies sourced from the public npm registry into your secure Cloudsmith repository. This ensures that all your dependencies, including those from npm, are vetted, cached, and managed within Cloudsmith.

Let’s detail how to pull in a module hosted on npm, but proxied and cached via Cloudsmith.

Step 1: Set Up an Upstream Proxy in Cloudsmith

upstream to npm in your Cloudsmith repository

. This means that when a package is requested, Cloudsmith fetches it from npm, caches it, and serves it to your project.

 to direct Deno to use Cloudsmith as the source for npm packages:

Step 3: Configure deno.json for npm Module

 file, specify the npm module you want to import. For example, to use the express package:

This setup ensures that your project pulls the 

 package through Cloudsmith, adding a layer of security and control.

Integrating Cloudsmith with Deno allows you to manage all your npm packages, private or public, with the highest security, visibility, and control levels. This integration supports modern DevOps practices, ensuring that your software supply chain is secure and efficient. This ultimately leads to faster development cycles and more reliable deployments. Start using Cloudsmith with Deno today and see how it can transform your development workflow.

Start using Cloudsmith with Deno today and see the difference it can make in your development workflow!

Level up your private npm registries in Deno with Cloudsmith

Cloudsmith brings the concept of flow—removing barriers and streamlining processes to keep everything moving smoothly - to artifact management. We want to help teams focus on what really matters: delivering value swiftly and efficiently.

The speakers at ShipItCon kept mentioning the importance of flow, especially how it ties in with observability, cloud processing, reducing handoffs, and building durable teams. Mihai Paun and Alma Tarfa discussed harnessing developer feedback to boost productivity, and Jim Dowling delved into the complexities of building AI systems. The message was clear: achieving flow is crucial, but it’s no walk in the park.

Claire Burn’s talk was another highlight. She shared her team's tough decision to pivot away from Kubernetes after realizing it wasn’t the right fit for their needs. This decision was a prime example of overcoming the sunk cost fallacy—choosing to prioritize flow and efficiency over sticking with a tool that wasn’t serving their goals. It reinforced the idea that sometimes, maintaining flow requires the courage to reassess and change direction.

Jim Dowling’s session on MLOps was another eye-opener. He laid out just how challenging it is to maintain flow when you’re dealing with AI systems. The sheer number of pipelines, the complexity of managing data, and the different competencies required all create significant obstacles. It got me thinking about how Cloudsmith might be able to help alleviate some of these pains—perhaps by simplifying artifact management in MLOps, making it easier for teams to keep that flow going.

Sam Newman also urged us to revisit the Agile Manifesto, reminding us that its principles, like "Individuals and Interactions over Processes and Tools," are still relevant. It’s a timely reminder that no matter how much our tools and processes evolve, the human element remains key to achieving flow.

Matthew Skelton’s talk connected the dots between flow, cloud capabilities, and organizational performance.

Dora’s Accelerate State of DevOps reports

, which demonstrate that effective use of cloud technologies is predictive of improved software delivery performance and availability. At Cloudsmith, we certainly agree!

Achieving flow is also rooted in the underlying culture. This was a recurring theme at ShipItCon, where several speakers highlighted how a well-nurtured environment is essential for maintaining a high-flow state. At Cloudsmith, we are guided by the 

ture of Honesty, Transparency, Improvement, and Sustainable Pace.

The talks this year were a nice blend of visionary thinking and practical advice. Charity Majors pushed us to think about how observability and flow should evolve together, while Paweł Malon and Paul Dailly offered practical insights for implementing observability to boost team effectiveness.

ShipItCon 2024's theme of flow was woven through every discussion. It’s a reminder to maintain smooth, efficient processes in everything we do—enhancing developer experiences, navigating the challenges of AI, or cutting down on the clutter in our pipelines.

Reflecting on ShipItCon 2024: High-performing teams need flow

We just released the Cloudsmith CLI GitHub Action. This new GitHub Action simplifies the process of installing and pre-authenticating the Cloudsmith CLI using OpenID Connect (OIDC) or an API Key. Whether managing packages, pushing artifacts, or automating your CI/CD workflows, this action is designed to streamline your experience and enhance your productivity.

1. Easy Installation of Cloudsmith CLI 📦

With this GitHub Action, you can effortlessly install the Cloudsmith CLI in your workflows. No more manual installations or complex setup processes. Simply add the action to your workflow, and the CLI will be ready to use.

One of the standout features of this action is its ability to pre-authenticate the Cloudsmith CLI using OIDC. By leveraging OIDC, you can securely authenticate without the need to manage API keys. This is particularly useful for organizations that prioritize security and want to minimize the exposure of sensitive credentials.

3. Support for API Key Authentication 🔑

In addition to OIDC, the action also supports authentication using an API Key. This provides flexibility for users who prefer or require API Key-based authentication. You can easily switch between authentication methods based on your needs.

The action comes with several customizable inputs, allowing you to tailor the setup to your specific requirements. You can specify the CLI version, provide the OIDC namespace and service slug, set the API Key, and more. This level of customization ensures that the action fits seamlessly into your existing workflows.

5. Seamless Integration with GitHub Actions 🤝

Designed to work seamlessly with GitHub Actions, this action integrates smoothly into your CI/CD pipelines. Whether you are building, testing, or deploying, the Cloudsmith CLI GitHub Action enhances your workflow automation and efficiency.

Ready to enhance your GitHub Actions workflows with the Cloudsmith CLI? Check out the 

 for more details and start integrating the action into your projects today.

For more information on Cloudsmith and its features, visit the 

For any questions or feedback, feel free to open an issue on the 

 or reach out to the maintainers. Thank you for your support!

Bartosz Blizniak

Senior Support Engineer

Announcing the Release of Cloudsmith CLI GitHub Action 🚀

1 year ago today, I became a Cloudsmither. I joined this incredible company that 

 co-founded because we have an incredible product, built for a massive market, and we were really just getting started.

, the blog stands up as a solid argument for Cloudsmith. We’re displacing legacy artifact management vendors, winning some of their largest enterprise customers with full-scale replacements across hundreds of teams with thousands of developers.

As I approached my 1-year anniversary, I asked myself what 

 makes Cloudsmith special. I landed on three particular qualities of our personality that I think are ultimately the winning qualities that will make Cloudsmith a truly great and historic company.

. Cloudsmith has been multi-tenant software-as-a-service (SaaS) from the first lines of code Lee wrote back in 2016. When your native language is cloud SaaS, you solve a different class of problems. You’re constantly optimizing for throughput, performance, and uptime. Internally, our engineers refer to the company as “Cachesmith.” I love that.

Of course, that means that when we add new edge servers, or find a clever way to serve packages, or rebuild indexes, or redistribute worker queues, or improve EFS throughput, our entire customer base benefits. Our small and mid-size customers get the same performance boost as our largest enterprise customers. Without requiring an upgrade, or a maintenance window. SaaS has been the standard in many corners of the software world for the past decade or more, but it’s still relatively rare for artifact management, in part due to sheer scale - we’re moving around data volumes measured in petabytes, after all.

Cloudsmith is constantly thinking about how to make our global package delivery network faster and more reliable, so our customers don’t have to worry about it. Our massive cloud infrastructure is a big barrier to entry; it’d be hard for a startup to compete with us anytime soon. It’s also hard for any single team, at even the largest enterprise, to compete with our level of scale and global reach. By depending on Cloudsmith to power their artifact repositories, our customers get to focus on building their own great software.

. We really care about the internals of all the different package managers. We get excited about trends across the public open-source registries. We keep up on the latest advances in security scanning, provenance, and developer-native distribution. We obsess over how our customers can make their build pipeline more efficient and how we can make it easier to migrate tools to Cloudsmith. We’re giddy about ways to stream more real-time data to our customers’ reporting and analytics tools.

. That’s another way of saying we’re customer-focused, but at Cloudsmith that manifests itself as truly proactive support. We love finding and fixing problems before our customers are even aware of them. When you build a culture that rewards the kind of intellectual curiosity I’ve described here, you’re able to run faster. Sure, we have distinct roles for our customer support engineers and our product engineers. But when a customer issue pops up in our monitoring systems, we swarm the problem. This is true DevOps—our engineering team stays close to the runtime. It’s another aspect of SaaS that legacy on-premise single-instance software companies just can’t compete with.

Cloudsmith solves a boring problem. For our core customer persona—platform engineering teams—boring is good. Platform engineering is responsible to their developer teams for getting packages where they need to go. We do this for our customers, so we’ve solved a really specific pain. Business school 101—focus on what differentiates you; outsource the rest.

 every day. Thank you to Lee and Alan for embracing me, empowering me to lead Cloudsmith, and allowing us to act as a united leadership team. And thank you to all of our customers for your trust and loyalty. We’ll do everything we can to continue to earn them. I’m always open to your feedback: 

Glenn Weinstein

What Makes Cloudsmith Special: Reflections on 1 Year as CEO

Organizations rely heavily on open source packages from public repositories like Maven Central, npm, PyPI, RubyGems, Docker Hub, and many more. While these repositories are vital for development, they also present risks as they are targets for malicious actors exploiting vulnerabilities within the software supply chain.

Many software development teams connect their IDEs and their build tools directly to these public repositories, downloading open source software (OSS) packages without any controls or checks. This can expose your production system to security vulnerabilities and compliance issues.

Cloudsmith’s cloud-native artifact management platform

 is ideally positioned to help you manage and control your open source dependencies. By using Cloudsmith as a dependency firewall, you create a layer of protection between your systems and these threats. A key set of Cloudsmith features, including package management, package scanning, upstreams, and policy management, ensures all binaries and dependencies are verified and controlled so you can increase your level of security and compliance.

Let's explore common hurdles organizations face when managing open source software and proprietary binaries, and how a dependency firewall can mitigate these risks.

It can be difficult to determine what open source dependencies, including transitive dependencies, are in your software builds.

Developers may pull packages directly from public repositories, potentially introducing vulnerabilities.

Public repositories don’t provide any guarantees that a package that was there yesterday, and that you now depend on, will still be there today. The repositories themselves also don’t offer SLAs and may suffer downtime.

Open source software can contain a dizzying variety of licenses. Inadvertently introducing new types of OSS licensing can create a threat to legal compliance and alter the legal status of your software, exposing you to litigation.

Cloudsmith's Dependency Firewall is a set of features built to secure and control your software binaries and their dependencies. Here’s how to use it to empower your team.

Centralize all software assets in Cloudsmith for a comprehensive view of all packages, across all formats. Cloudsmith offers native support for over 30 

, including raw digital assets, so all of these artifacts are subject to the same controls.

Instead of allowing developers to download OSS directly from public repositories, set up 

 to proxy and cache OSS artifacts from public sources through Cloudsmith. Upstreams ensure all dependencies are under your control, safeguarding against outages or unexpected removals of OSS packages from public repositories.

 for vulnerabilities and malware upon upload to Cloudsmith, when they’re fetched from upstream sources.

, so you can be protected against vulnerabilities that may be discovered in a package after it’s already been cached by Cloudsmith.

 and match it against the SPDX License list. You’ll be able to see all OSS licenses you’ve introduced by way of dependencies.

The key to making use of data produced by vulnerability, malware, and license scanning to actually protect your software supply chain is Cloudsmith’s 

. Creating polices allows you to implement sophisticated rules that govern whether packages will be allowed to enter builds, or will be subject to quarantine. Policy types include:

 Cloudsmith can enforce quarantine measures for packages that fail policy checks. This can be configured to prevent quarantined packages from being used until they are reviewed by a security team, and ultimately approved or permanently blocked.

Cloudsmith’s policy engine uses the same powerful boolean logic as our package search engine. This lets you create detailed rules that consider various package attributes, such as version numbers or metadata, ensuring highly targeted and effective policy enforcement.

Cloudsmith Blog

Cloudsmith is headed to Salt Lake City for KubeCon North America 2024

How to Manage Your Package Promotion Workflows with Cloudsmith

Level up your private npm registries in Deno with Cloudsmith

Reflecting on ShipItCon 2024: High-performing teams need flow

Announcing the Release of Cloudsmith CLI GitHub Action 🚀

What Makes Cloudsmith Special: Reflections on 1 Year as CEO

Using Cloudsmith as a Dependency Firewall

5 Lessons on the Evolution From DevOps to Platform Engineering

Fortify Dependency Management With Cloudsmith + Dependabot

Implementing Zero Trust Security With Cloudsmith in 5 Steps

Kong Entrusts Cloudsmith With Global Distribution

12 Signs of Stellar Support in an Artifact Management Vendor