By submitting this form, you agree to our 

The term 'cloud' has become a buzzword in the tech industry, often used interchangeably to describe anything from online storage to complex computing services. But what does it really mean? And more importantly, what is cloud-native, and how does it differ from cloud-based?

“The Cloud” is a concept that has certainly revolutionized the way we store, manage, and interact with data. But as with any technological advancement, the cloud comes with its own set of terminologies that can often be confusing. Two such terms that often cause a confusion are 'cloud-native' and 'cloud-based'. While they might sound similar, they represent different approaches to using the cloud. Understanding these differences is crucial for businesses aiming to leverage the cloud effectively.


In this blog post, we'll look at the differences between cloud-native and cloud-based applications, explore their pros and cons, and help you understand which approach might be the best fit for your business. We'll also introduce you to Cloudsmith (that’s us!) a cloud-native tool designed to streamline your software supply chain management, giving you complete control over how you distribute software.

Understanding Cloud Applications: A Tale of Two Clouds

Cloud-based applications are akin to a well-loved, well-used piece of furniture that you've decided to move into a new house. These applications were originally designed to run on local servers or personal computers but have been relocated to the cloud. While this move offers the benefits of the cloud, such as remote access and reduced physical infrastructure, it also brings along some of the old furniture's quirks.

Cloud-based applications tend to be tightly integrated, meaning their components are interconnected and dependent on each other. This integration can be a strength, providing consistency and reliability. However, it also means that when one part of the application needs an upgrade or encounters an issue, the entire system might need to be taken offline. This can lead to downtime, which can disrupt operations and impact productivity.

Cloud-native applications are like a house built from scratch, designed to fit the specific characteristics of its location. These applications are designed specifically for the cloud environment from the get-go. They're built to be flexible, scalable, and resilient, taking full advantage of the cloud's capabilities.

Cloud-native applications often employ a microservice architecture. This means they're composed of small, independent services that work together, much like a well-coordinated sports team. Each player (or service) has a specific role and can operate independently of the others. This independence means that individual parts of a cloud-native application can be updated, scaled, or even taken offline without disrupting the entire system.

Comparing Cloud-Native and Cloud-Based Applications

So what's the difference between cloud-native and cloud-based? It all comes down to design philosophy, implementation strategy, maintenance requirements, and cost efficiency

: Cloud-native applications are faster to deploy because there's no need for traditional hardware or software installation.

: Microservices allow cloud-native applications to scale seamlessly, whereas cloud-based applications may struggle due to architectural constraints.

: Cloud-native apps are built for resiliency, reducing the risk of downtime during updates or outages.

: With cloud-native architecture, you only pay for the resources you actually use.

Cloud-based applications, while still offering the benefits of the cloud, can be slower to deploy and more prone to interruptions. Because they weren't originally designed for the cloud, they might not be able to take full advantage of all the cloud's benefits.

The Benefits of Using a Cloud-Native Tool: Introducing Cloudsmith

Enter Cloudsmith, a cloud-native tool, fully managed, universal artifact management platform. Cloudsmith is designed to help you manage your software assets efficiently and securely, giving you complete control over your software supply chain.

Here are some of the key benefits of using cloud-native applications:

: Easily scale applications up or down based on demand.

: Continuous delivery pipelines allow rapid release and updates.

: Built-in fault tolerance and self-healing capabilities.

: Minimal maintenance required with managed services.

: Pay only for the cloud resources you use.

: Developers can work independently on microservices.

: Frequent updates and centralized control reduce vulnerabilities.

But why is artifact management so important? In the world of software development, an artifact is any file or resource that is produced during the software development process. This could be anything from compiled source code and documentation to test data and final software packages. Managing these artifacts effectively is crucial for maintaining the efficiency, reliability, and security of your software supply chain. It allows you to keep track of the different versions of your software, ensure that your teams are always working with the correct resources, and protect your software from potential security threats.

Cloudsmith provides a centralized platform for managing and distributing software packages. It's like having a dedicated, secure, and efficient delivery service for your software. You can track and control your software assets, ensuring they're delivered quickly and securely. It is flexible, scalable, and resilient, and making it the go-to cloud-native platform for modern software delivery.

, Cloudsmith is designed to grow and evolve with your business. It requires no infrastructure management, allowing you to focus on what really matters—building great software. It adapts to your workflows, integrates with your CI/CD pipelines, and scales effortlessly as your needs grow.

Choosing between cloud-native and cloud-based applications often comes down to your specific needs and circumstances. Both have their strengths and can offer significant benefits. But, cloud-native applications like Cloudsmith offer a level of flexibility, scalability, and resilience that's hard to beat. They're designed for the cloud, built to take full advantage of its capabilities, and ready to adapt to your organisation's evolving needs.

If you're looking for a cloud-native tool to help you take control of your software supply chain, look no further. Cloudsmith is built by developers, for developers, and it's ready to support your growth in the cloud era.

Explore the benefits of cloud-native applications today, and see how Cloudsmith can empower your team to move faster, safer, and smarter in the cloud.

1. What is the difference between cloud-native and cloud-based?


Cloud-native is built for the cloud from scratch. Cloud-based is migrated to the cloud but was originally designed for on-premises use.


A cloud-native application is designed specifically for cloud environments, using microservices, containers, and CI/CD for agility and scalability.

3. What are the benefits of cloud-native applications?


They offer faster deployment, high scalability, resilience, cost-efficiency, and better performance in cloud environments.


A cloud-native tool, like Cloudsmith, is built to run in the cloud, offering secure, scalable solutions for modern software development.

5. Why choose cloud-native over cloud-based

?
Cloud-native apps are more agile, resilient, and cost-efficient. They outperform cloud-based apps in speed, updates, and scalability.

6. Can a cloud-based app become cloud-native?


Yes, through re-architecture. Refactoring into microservices and using cloud-native tools helps modernize cloud-based apps.


Yes. Cloud-native platforms offer robust security features, continuous updates, and better isolation through containers.

8. Do I need DevOps for cloud-native development?


Yes, DevOps practices like CI/CD are crucial to take full advantage of cloud-native architecture and automation.

Lee Skillen

Chief Technology Officer

Cloud-Based vs Cloud-Native: What’s the difference?

"Artifact" and "package" are often used interchangeably, but they have distinct differences. Understand their unique roles, learn through practical examples, and discover why distinguishing between them is vital for effective software management and distribution.

In the context of software development, the terms "

" are often used interchangeably, even though they do have distinct meanings. The difference between software artifacts and packages often creates confusion, but understanding the differences will equip you to manage your software development process more effectively and make more informed decisions about tooling and processes.

Software artifact is a broad term that refers to any file or collection of files produced as a result of a process. Think of artifacts as the tangible outputs of your software development lifecycle. They can be as varied as compiled source code, libraries, executables, configuration files, and more.

Why are artifacts important in software development?


Artifacts are the building blocks of your software project. They are the tangible results of each step in your development process, and each one plays a crucial role in the final product. Without these artifacts, there would be no record of your work, making it difficult to track progress, troubleshoot issues, or collaborate effectively.

Libraries are designed to be used by other programs and are loaded into a program during its runtime. They provide a way for code to be modular, reusable, and efficient. Instead of writing the same code from scratch for every new project, developers can use libraries to reuse code that performs common tasks.

: After the source code is written, it's often compiled into a format that a machine can read and execute. These compiled files, also known as binaries, are a crucial type of artifact in many programming languages. For example, in Java, source code files (.java) are compiled into bytecode files (.class) that can be executed by the Java Virtual Machine (JVM). In C++, source code files (.cpp) are compiled into executable files (.exe on Windows, no extension on Unix/Linux) that can be run directly on the appropriate operating system.

: In the world of containerization, Docker images have become a very important type of artifact. A Docker image is a lightweight executable that includes all the necessary components to run a piece of software. Docker images are built from a Dockerfile and a "context," which is a set of files that provide the source code and other resources needed for the application. Once built, Docker images are stored in a Docker registry and can be pulled and run on any host that has Docker installed. This makes Docker images an incredibly flexible and portable type of artifact, enabling consistent behavior across different environments and platforms.

Now let's talk about packages. A package is a specific type of artifact that contains code along with the metadata required to resolve its dependencies and install it correctly. Package management systems help organize these packages, ensuring they can be easily installed, updated, and removed. Packages are like neatly wrapped presents, containing everything you need (the compiled code) along with a note (the metadata) explaining how to use it.

Examples of packages include a Java JAR file, a Python Wheel or Egg file, a Ruby Gem, a Node.js NPM package, or a .NET NuGet package. Packages are typically versioned and can be distributed as a unit, making them an essential tool for software distribution and deployment.

Artifact vs Packages: What's the Difference?

So what's the difference between software artifacts and packages? Here's the key point: while all packages are artifacts, not all artifacts are packages.

Think of it this way: an artifact is any output of the software development process. It's a broad term that encompasses all the tangible products of your work. A package, on the other hand, is a specific type of artifact that's designed for distribution. It's like a subset of artifacts with some extra features that make it suitable for sharing and deploying.

A package includes not only the code (which is an artifact in itself) but also metadata that describes how to install and use it. This metadata can include information about the package's dependencies, its version, and other details that help to manage its installation and use.

In other words, a package is a more specialized form of artifact. It's an artifact that's been packaged up (hence the name) with all the information needed to distribute and deploy it.

Understanding the difference between artifacts and packages is more than just a matter of semantics; it has practical implications for how we manage and distribute software.

When we understand that all packages are artifacts, but not all artifacts are packages, we can make more informed decisions about how to manage our software development process. For example, we might decide to store all our artifacts in a repository for safekeeping but only distribute certain artifacts (i.e., packages) to users or other developers.

Moreover, understanding the difference can help us to use the right tools for the job. Some tools are designed to manage artifacts in general, while others are specifically designed for package management. By understanding what we're working with (whether it's an artifact or a package), we can choose the most appropriate tool and use it effectively.

Cloudsmith supports both artifacts and packages, including RAW files, zip, PDFs, and open source packages. Once uploaded to Cloudsmith, we then control distribution to developers, servers, or external customers. Our primary mission is to contain 100% of the software and related data for users within Cloudsmith, keeping everyone safe.

The artifact vs package distinction might seem small, but it can have significant implications for how we manage and distribute software. By understanding these nuances, we can make the most of our tools and processes and ultimately deliver better software.

Remember, what are artifacts? They are any output of the software development process, while a package is a specific type of artifact designed for distribution. While all packages are artifacts, not all artifacts are packages. This distinction is crucial for effective software management and distribution.

As you continue your journey in software development, keep this distinction in mind. Use it to guide your decisions and to help you choose the right tools for your needs. Remember, understanding the terminology is just the first step. The real magic happens when you apply this knowledge in practice. Happy coding!

Why are artifacts important in the software development lifecycle?


Software artifacts provide tangible outputs for tracking progress, enabling collaboration, and creating an audit trail of all project components.

How do DevOps practices benefit from artifact repositories?


DevOps relies on software artifacts for consistent deployments across environments. The difference between software artifacts and packages impacts automation pipelines.

How does package management differ from artifact management?


Package management handles distribution-ready code with dependencies, while artifact management covers all development outputs regardless of distribution status.

Decoding the Difference: Artifacts vs Packages in Software Development

Cloudsmith celebrates being honored with two prestigious G2 awards: "Best Relationship Summer 2023" and "High Performer Summer 2023". Discover how our commitment to exceptional customer service and a best-in-class software supply chain management platform earned us these badges.

We're excited to share some fantastic news! Thanks to the unwavering support and positive feedback from our incredible users, Cloudsmith has been honored with two prestigious awards from G2: "Best Relationship Summer 2023" and "High Performer Summer 2023". These reflect our commitment to delivering exceptional customer service and a best-in-class software supply chain management platform.

Cloudsmith: A High Performer with Best-in-Class Relationships

Our users have shared their experiences with Cloudsmith on G2, contributing glowing reviews through and through. Their invaluable feedback has led to this recognition, and we are committed to continue to provide excellent developer experience and support to everyone. We believe that our users are the heart of our platform, and these awards are a testament to the strong relationships we've built with them. We're dedicated to maintaining this high level of customer satisfaction and will continue to strive for excellence in all our interactions.

Our goal has always been to equip our customers with the tools they need to manage their software supply chain more efficiently and securely. Seeing our customers succeed and grow with our platform is the most rewarding part of our work.

You might be wondering what makes Cloudsmith stand out from other software supply chain management platforms. The answer lies in our deep understanding of the complexities of managing software assets, while always putting the developer experience at the forefront of everything we do. We understand that no two teams work the same, and flexibility and scalability are two core tenants of how we operate. We believe in a human-first approach to software development, with our own engineers always at hand to help when needed.

Cloudsmith is more than just a software supply chain management platform. It's a solution designed by developers, for developers. We've taken our firsthand experience and used it to create a platform that addresses the unique challenges developers face. From managing dependencies to ensuring secure distribution, Cloudsmith is designed to be the source of truth for software everywhere. We like to think we are more than just a tool; we are part of your journey to building amazing products.

We are here to empower teams to deliver software faster, without restrictions of managing different asset types, while remaining scalable and cost-efficient. From source to delivery — with complete trust, control, and security. We're committed to providing a platform that not only meets the needs of today's developers but also anticipates the challenges of tomorrow.

We couldn't have achieved this without you! The feedback we receive from users on G2 is invaluable to us. It gives us great insight into what we are doing well and how we can improve. We're always looking for ways to enhance our platform and services, and your feedback is a crucial part of that process. Every review, every comment, every suggestion helps us shape Cloudsmith into a better platform.

Here are just a few of the brilliant reviews from our users on G2 that make us feel proud:


"For us, it's a developer first platform. That means that you have clear, full documentation and mostly every single edge case you could think of out of the box. For those questions or things that seem a bit unusual, a quick chat with support results in either resolution or a feature request which is properly considered and often makes it into the platform."

"It is so easy get started with the tool! There is a description for every feature and even for 3rd party tools that just work with cloudsmith. You also have a very clear and structured overview of your repositories and packages. It works great with different package managers."

"Cloudsmith is easy to use, has comprehensive features we need and has excellent support from the Cloudsmith team."

On behalf of all of us here at Cloudsmith, we’d like to extend a huge thank you to our incredible customers for their continued support. Your success is our success, and we're excited to continue working with you to make software supply chain management as efficient and secure as possible.

Be sure to head over to our profile on G2 to see other reviews that customers have left for us—or if you're in the mood—

As we celebrate these achievements, we're also looking forward to the future. We're committed to continuous improvement and innovation, and we're excited about what's to come. We'll continue to listen to your feedback, enhance our platform, and provide the exceptional service you've come to expect from us.

We're not just looking at the next quarter or the next year; we're looking at the next decade. We're committed to staying at the forefront of software supply chain management, anticipating the challenges of the future, and providing solutions that meet those challenges head-on.

Thank you for choosing Cloudsmith. Here's to more success together! We're excited to continue this journey with you, and we can't wait to see what the future holds.

Celebrating Success: Cloudsmith Recognized by G2

Efficiency and organization are key when it comes to 

. As teams work to deliver high-quality software at an increasingly fast pace, the need for effective management of the various components of the software development lifecycle has become paramount. One aspect of this lifecycle that often gets overlooked, but is crucial to the smooth functioning of the development process, is artifact management.

Let’s explore artifact management, what it means for you as a developer, why it's an essential part of your toolkit, and the numerous benefits it can bring to your software development process.

Artifact management refers to the process of storing, versioning, and tracking binary files, or "artifacts," that are produced during the software development process. These artifacts can include compiled source code, libraries, and documentation, including operating packages, NPM and Maven packages (or container images like Docker.) The goal of artifact management is to ensure that these files are stored in a secure, organized, and accessible manner, enabling developers to retrieve and deploy them as needed.

Artifact management is about creating a systematic approach to handle the various outputs of your software development lifecycle. It's like a library for your software components, where each artifact is a book that needs to be properly cataloged, stored, and made available for future reference.

Devops entail a set of practices that aims to shorten the system development life cycle and provide continuous delivery with high software quality. In this context, artifact management plays a vital role in maintaining the speed, efficiency, and reliability of the software development and deployment process.

In a DevOps environment, the rapid, continuous development and deployment of software can generate a large number of artifacts. Without a proper management system, these artifacts can become disorganized and difficult to track, slowing down the development process and increasing the risk of errors or security breaches.

Artifact management tools help to address these challenges by providing a centralized repository for storing and tracking artifacts. This not only helps to keep the artifacts organized, but also makes it easier for developers to find and deploy the correct versions of the artifacts they need.

These types of tools can provide additional features such as access control, versioning, and metadata management, which can further enhance the efficiency and reliability of the software development process.


10 Benefits of using an Artifact Management Platform

Artifact management systems provide robust controls for managing the flow of artifacts, including features for promoting, rolling back, and deploying packages. This gives you the ability to manage your software components in a structured and organized manner, ensuring that only the correct versions are deployed.

These systems offer a comprehensive view of your artifacts, including their names, versions, types, and metadata, helping you to keep track of your assets. This visibility is crucial for maintaining an overview of your software components and understanding their interdependencies.

Artifact repository tools can support multiple packaging technologies and provide APIs for easy manipulation, enhancing interoperability and flexibility. This means that regardless of the technology stack you're using, you can manage all your artifacts in a single, unified system. (Think of this like normalising the experience across multiple artifacts types/formats, kind of like bringing order to chaos!)

These systems are designed to be secure by default, providing features such as encryption in transit and at rest, digital signing, and permission management. This helps to protect your software components from unauthorized access and tampering, ensuring the integrity of your software.

Artifact management systems provide metadata for tracking the history and dependencies of your artifacts, enhancing accountability and reproducibility. This traceability is crucial for understanding the evolution of your software components and for troubleshooting issues that may arise.

These systems provide access logs and metrics for tracking the usage of your artifacts, helping you to monitor and optimize your operations. This auditing capability is crucial for maintaining accountability and for understanding how your software components are being used.

Artifact management systems offer fast, global distribution of your artifacts, helping to speed up the development and deployment process. This can significantly reduce the time it takes to get your software to market, giving you a competitive advantage.

These systems can provide a layer of redundancy for public services, ensuring that you can access your artifacts even if the public service is down. This availability is crucial for maintaining the continuity of your operations and for ensuring that you can deliver your software on time.

Artifact management systems support collaboration by allowing you to synchronize workflows and processes within distributed teams. This can enhance the efficiency of your operations and foster a culture of shared responsibility and teamwork.

Using an artifact management system can be more cost-effective than building and maintaining your own system, freeing up resources for you to focus on your core product. This can help you reduce costs, increase productivity, and deliver better software.

Artifact management is a crucial element of modern DevOps practices and software development workflows. By leveraging a dedicated artifact management platform, you can streamline development, ensure security, and improve software quality across the board.

Whether you're managing NPM packages, Docker containers, or custom binaries, implementing a robust artifact repository helps you build a faster, more resilient, and cost-effective artifact software development process.

1. What is artifact management in DevOps?

Artifact management in DevOps refers to storing, tracking, and deploying build artifacts securely and efficiently.

Artifact management ensures version control, traceability, and secure distribution in the software development lifecycle.

3. What does an artifact management platform do?

Artifact management platform stores, organizes, and secures software artifacts like binaries, containers, and libraries for CI/CD pipelines.

An artifact repository stores and manages software artifacts with metadata, versioning, and access control for developers.

5. Is artifact management useful for small teams?

Absolutely. Even small teams benefit from artifact organisation, faster deployments, and consistent builds.

6. What formats are supported by artifact management platforms?

Platforms like Cloudsmith support Docker, Helm, npm, Maven, PyPI, NuGet, and more.


10 Awesome Benefits of Artifact Management and Why You Need It

It’s no surprise that AI is rapidly becoming the most powerful tool for developers. The ease of use and accuracy of such tools can even generate code snippets for a website written entirely on a napkin! While the potential of AI is exciting, it is crucial to address the potential vulnerabilities that bad actors can exploit within AI systems.

Regardless of the scale of a development project, whether it's a school assignment or a large-scale corporate venture involving multiple developers, they will all have one thing in common, packages! These can range from your usual NPM or Python packages to your core infrastructure servers running Linux that utilize RPM/DEB packages.

Potential Vulnerabilities: Exploiting AI Systems for Malicious Purposes


Bad actors have already found a way to exploit ChatGPT for software supply chain attacks, leveraging the service to introduce malicious packages into various systems. These packages may possess critical known vulnerabilities, be discontinued, or be deliberately crafted as malicious entities while still providing the functionality that the developer needs, avoiding suspicion. By manipulating data from various popular online sources, they can propagate false positive information about specific packages and their functionality. Particularly challenging is the fact that ChatGPT's training data is limited to a specific timeframe, leading to potential nightmares for large organizations progressively integrating ChatGPT into their development workflows.

To illustrate these risks, let's consider a simple scenario in which I asked ChatGPT to create a Node.js application for displaying local weather information:

From the provided screenshot, we can see that ChatGPT's initial instruction is to install package dependencies from NPM. While these packages may seem safe at first glance (They are!), their future integrity cannot be guaranteed due to ChatGPT's inability to verify their safety beyond its training data.

Understanding the Impact of Outdated Training Data

Notably, as of the publication of this blog, the free version of ChatGPT relies on data from September 2021, rendering it two years outdated. This poses a significant concern for packages that frequently receive security updates.

Interestingly, the command suggested by ChatGPT allows for the installation of the most recent version of a package, provided no specific version is specified. This proves beneficial for packages actively maintained and supported by the community. Nevertheless, for packages with limited maintenance or a history of security vulnerabilities, this approach exposes users to substantial risks, and providing the latest version wasn't always the case during my testing. For older projects where the dependencies are harder to update, the suggestions may include a specific version of a package that can be vulnerable.

The absence of real-time data access restricts ChatGPT's awareness of the latest updates or security patches released for packages. Consequently, users become vulnerable to potential security breaches. Malicious actors can exploit outdated packages by injecting malevolent code, thereby leading to devastating consequences such as data breaches, system compromises, or complete takeover of affected systems.

Enhancing Package Security with Cloudsmith

To mitigate this risk, Software as a Service (SaaS) solutions like Cloudsmith provide invaluable assistance. Cloudsmith offers a comprehensive package management solution, centralizing and securing the storage, management, and distribution of software packages.

By leveraging Cloudsmith, developers gain superior control over the packages integrated into their applications. Instead of relying solely on ChatGPT's recommendations, developers can actively scrutinize and verify the packages' authenticity, ensuring they originate from trusted sources. Even if the developer still decides to copy and paste the instructions from ChatGPT, an organization utilizing Cloudsmith will ensure that the packages are pulled through Cloudsmith, ensuring security throughout the entire organization.

Cloudsmith also offers advanced features such as package vulnerability monitoring and real-time alerts through webhooks. Through continuous scanning of packages within its repository, Cloudsmith identifies known vulnerabilities, enabling developers to remain informed about potential security risks. Consequently, even if ChatGPT suggests a package with security vulnerabilities, Cloudsmith can promptly flag it and notify developers to take appropriate action.

The potential consequences of relying solely on ChatGPT's recommendations for package installation become even more apparent when considering the dynamic nature of the software development landscape. New vulnerabilities and security patches are regularly discovered and released, rendering even recently installed packages potentially obsolete or vulnerable. The absence of real-time data access restricts ChatGPT's awareness of these updates, leaving users exposed to potential security breaches. This highlights the critical importance of staying up to date with the latest information on package vulnerabilities and security patches.

Proactive Measures: Automated Vulnerability Monitoring and Real-Time Alerts

Fortunately, there are proactive measures that developers can take to mitigate these risks. One such measure is to implement automated vulnerability monitoring and real-time alerts within the development workflow. By integrating tools like Snyk or WhiteSource into the package management process, developers can receive immediate notifications when a package used in their project is discovered to have a vulnerability. These alerts enable developers to take swift action, such as updating to a patched version or finding an alternative package, thus minimizing the window of opportunity for attackers.

Developers should prioritize establishing a culture of security within their organizations. This includes fostering a mindset of continuous learning and staying informed about emerging security threats and best practices. By investing in regular training and knowledge-sharing sessions, developers can strengthen their understanding of secure coding practices, vulnerability management, and the potential risks associated with AI-powered tools. Ultimately, a well-informed and security-conscious development team is better equipped to identify and mitigate potential vulnerabilities introduced by AI systems.

In conclusion, while ChatGPT's lack of access to live data poses the risk of receiving outdated or vulnerable packages, incorporating robust package management practices and utilizing SaaS tools like Cloudsmith significantly mitigate this risk. By prioritizing stringent package vetting and harnessing tools that provide real-time security insights, developers can enhance the security and integrity of their software projects.

Bartosz Blizniak

Senior Support Engineer

ChatGPT: Friend or Foe? Protect your dev team from the Dark Side!

Yesterday we launched the third iteration of cloudsmith.com

JUST LOOK HOW AWESOME AND BEAUTIFUL IT IS!

The new website is a significant upgrade in every way, from tech stack to color, structure to copy. Absolutely everything with the existing site was poked, probed, questioned, and rebuilt from the ground up.

The project, headed up by our own Paul May, working with 

, have built something great. A new brand, a new site, and a whole new design language that embodies the Cloudsmith product and mission; to provide world-class support for artifact management, software distribution, and helping companies lower their risk with software supply chain management.

Perhaps the most significant change is the new brand mark. The new logo represents the next stage of evolution for Cloudsmith. We are past the initial startup stage, firmly into scale-up mode, and slowly over time, a maturity has seeped into the company. And the new logo is a reflection of that.

Cloudsmith was named as such to represent our passion and drive for cloud-native, and a product sitting central to the ecosystem of dev tools for building software pipelines.

There were some fairly obvious attempts (by others) to brand cloudsmith (with a small c here to represent the others that used the name, or variations of the name) as a cloud with a hammer.

When we came to branding Cloudsmith initially we didn’t want to be so obvious. After a few rounds of pitching and discussion, we landed on the mark that we’ve used since 2016.

A sort of amorphous blob, that kind of looked like a ‘C’, kind of looked like a cloud (on its side) and kind of looked like the common share icon. Married up to the text mark, in Ubuntu Bold font (we were proud of that choice) we ended up with a logo that remained pretty consistent as it has spread over the internet, events, and merch over the last seven years.

We grew to really love it. We had fun with it. We used to hide it both in plain sight and somewhat subtly in stock images we used for blog images. When we started generating art in-house for the blogs, we’d be creative with it.

It wasn’t without issue though. Its “center of gravity” wasn’t central, and so for places like Twitter where it was enclosed with a box or circle, we had versions where it was off-centered so that it looked central. And over the years, similar logos have appeared in lots of places. But as we were building awareness, we were reluctant to change something that seemed so core to the company, product, and ourselves.

There is nothing permanent except change.
(Heraclitus)

It was time. Time to change. Time to grow up and relinquish some control. Take all the things we’ve learned about the company, the market, and our amazing customers, and distill it down into something new.

Cloudsmith has always been about delivery. Distribution. Providing the artifacts you need, to where you need them. Building software pipelines, deploying software, distributing software to your customers. We provide that fully-managed core infrastructure for you, twenty-four hours a day, seven days a week. It’s foundational tech that drives business value and saves you a lot of heartache.

Everything we do, we do to make developers' lives easier.

The new logo represents that. A simple design (simple is hard, btw) that encapsulates the thematic pipelines and artifacts that drive our value to you. The inner circle harks back to the old logo and where we came from. The mechanical nut similarity emphasizes the ‘smith’ side of building something great.

Alan Carson

Co-founder and Chief Strategy Officer

A New Lick of Paint

Cloudsmith is proud to present its inaugural conference for DevOps professionals and engineering leaders, 

. This event will take place online on Tuesday, June 20, 2023 starting at 9 AM PT and will provide attendees with valuable insights into securing and scaling software delivery.

Unpacked will be attended by industry leaders from across the globe, who will gather to discuss topics such as software distribution at scale, securing open source dependencies, and reducing complexity and cost. The conference is designed to provide attendees with valuable information and tools for optimizing their software delivery pipelines.

"As our world grows more connected through software, it's essential to prioritize secure and efficient delivery," shared Lee Skillen, Co-Founder and CTO of Cloudsmith. "At Unpacked, attendees will enjoy the opportunity to learn from distinguished industry leaders, exchange insightful experiences, and gather practical knowledge to elevate their software delivery pipelines to new levels of effectiveness."


Luke Hinds, Distinguished Engineer, Red Hat (Formerly)

Mel Kaufuss, Developer Advocate, Buildkite

Tamara Miner, Principal Strategy Consultant, Pragma Platform (former VP Engineering, disguise Technologies)

Peter Wagner, Staff Infrastructure Security Developer, Shopify

The conference will be hosted by Cloudsmith’s Co-Founder and CEO, Alan Carson. More speaker announcements to follow.

In addition to sessions presented by industry thought leaders, Unpacked will also include virtual networking opportunities, a virtual expo, and a chance for attendees to win prizes.

Unpacked is presented by Cloudsmith with support from community sponsors Chainguard, CircleCi, CodeSee, LinearB, Namespace Labs, Roadie, and Spacelift. The conference is free to attend and free to sponsor. More information and registration details can be found at 

At Cloudsmith, our mission is to evolve the cloud-native supply chain, making it simple for developers to secure their software delivery at scale through universal artifact management. With Cloudsmith, you can manage 28+ package formats from a single, cloud-native repository giving you visibility into you and your team's software supply chain.


Contact: Hillary Foster, Global Events and Sponsorships Lead, Cloudsmith hfoster@cloudsmith.com | events@cloudsmith.com

Cloudsmith Presents Unpacked: A Virtual Conference for DevOps Professionals and Engineering Leaders happening June 20, 2023

The team at Cloudsmith is always looking for ways our customers and community can leverage adjacent technologies within the DevOps and application development ecosystem to secure the software supply chain. Cloudsmith developed the first 

, the Cloud Monitoring as a Service solution, a few years ago! That integration was the first step in helping the community leverage both solutions simultaneously, strength for strength. We are excited to introduce the latest enhancement to the community integration, 

 describing the integration between Datadog and Cloudsmith and how it allows developers to monitor the health and performance of their software packages by highlighting the most common metrics, all from the Datadog UI. The initially supported metrics are detailed below:

, the discussion covered a variety of topics but some of the overarching themes were reducing complexity and security. These themes are popular amongst developers, and Cloudsmith is committed to building meaningful solutions for our great customers and community. The next step in this journey is providing additional Cloudsmith visibility in Datadog.

Cloudsmith Vulnerability Scanning will automatically scan supported package types for CVEs upon package upload. As you can see from the image above, all results from this capability can now be seen via the Datadog dashboard. This is in addition to existing capabilities within the Cloudsmith Web UI, the 

. The Cloudsmith Security Scan drives other actions including 

, preventing users and systems from downloading the compromised package.

The audit logs feature allows you to monitor all activity performed by the system, users or services in Cloudsmith, including creating or deleting a repository, modifications to repository settings, package deletions and quarantines, and more. Now alerts can be set up in Datadog based on the audit log data to receive notifications when suspicious activity is detected.

The addition of vulnerability scanning and audit logs to the Datadog-Cloudsmith integration provides developers with even more tools to monitor the health and security of their software packages. One of the biggest challenges developers and teams are struggling with is tooling or screen fatigue. By combining these features with Datadog's monitoring capabilities, developers can stay on top of any issues and ensure their packages are secure and reliable within the tool or screen that makes the most sense to them.

For the initial setup instructions for the Datadog-Cloudsmith integration, please refer to our 

Datadog Integration Update: Vulnerability Scanning and Audit Logs

The Cloudsmith Team is headed to Paris for the AWS Summit! You can find our team on Level 2 of the expo hall.

 A single source of truth for software artifacts has never been more vital to supply chains. Engineers need trust, provenance and a secure source for end-to-end software delivery, from build through to production. At Cloudsmith, our mission is to evolve the cloud native supply chain, making it simple for the developer community to secure their software delivery at scale through universal, cloud native, artifact repositories.



Dave McConville, Technical Account Manager | 

Cloudsmith is participating in the official AWS Summit passport program with a handful of other summit sponsors. Be sure to stop by our stand on level 2 of the expo hall to receive your stamp for a chance at the grand prize.

Everyone who stops by the Cloudsmith stand will also be entered to win an iPad 10th Generation.

Cloudsmith Blog

Cloud-Based vs Cloud-Native: What’s the difference?

Decoding the Difference: Artifacts vs Packages in Software Development

Celebrating Success: Cloudsmith Recognized by G2

10 Awesome Benefits of Artifact Management and Why You Need It

ChatGPT: Friend or Foe? Protect your dev team from the Dark Side!

A New Lick of Paint

Cloudsmith Presents Unpacked: A Virtual Conference for DevOps Professionals and Engineering Leaders happening June 20, 2023

Datadog Integration Update: Vulnerability Scanning and Audit Logs

The Cloudsmith Team is Headed to AWS Summit in Paris April 4!

Visit Cloudsmith at KubeCon + CloudNativeCon in Amsterdam!

Experience faster, more reliable builds with Cargo's new sparse registry protocol

Terraform Provider Enhancements