By submitting this form, you agree to our 

For organizations, distributing software artifacts effectively is crucial to building strong developer relationships and delivering a seamless experience. Yet, managing and personalizing the distribution of software packages—like SDKs or container images—can be challenging. Cloudsmith, a leader in cloud-native artifact management, has introduced 

With Broadcasts, Cloudsmith customers can manage, brand, and personalize their software delivery, ensuring a developer-native experience that aligns with the organization’s identity and meets end users where they are.

Artifact management is, at its heart, about software distribution, and it’s a natural extension of Cloudsmith’s powerful package delivery network

,” said Alan Carson, co-founder and chief strategy officer at Cloudsmith. “

With Broadcasts, customers can take full control and deliver a branded, professional experience that fosters deeper, richer relationships with their customers.

The New Standard for Artifact Distribution

Broadcasts transforms software distribution with a streamlined, brandable interface that lets organizations control which software they publicly share. Cloudsmith has incorporated branding elements, custom domains, and analytics, enabling companies to present a unified, professional experience to developers and gain insights into usage.

Key Features and Benefits of Cloudsmith Broadcasts

Broadcasts offers a cohesive, branded distribution experience through these features:

: Set up and manage Broadcasts with an easy-to-use interface, providing exact control over which artifacts are distributed, reducing setup time and enabling faster delivery.

: Organizations can use custom domains and branding elements to create a distribution page that reflects their brand, providing a recognizable and professional experience.

: Get insights from download data to understand usage trends, identify revenue opportunities, and enhance brand value.

: Broadcasts integrates with native developer tooling, allowing end users to access artifacts through their preferred CLI or CI/CD tool, creating a smooth, workflow-friendly experience.

: Powered by Cloudsmith’s extensive network, Broadcasts ensures reliable, fast distribution worldwide with over 600 points of presence, so users receive content instantly.

How Broadcasts Solves Distribution Challenges

Cloudsmith’s Broadcasts tackles key software distribution challenges by providing tools to control, brand, and analyze distribution:

: Customized distribution pages create a seamless, familiar experience for users and reinforce brand identity.

: Analytics provide actionable information on download trends and engagement, supporting marketing strategies and potential revenue growth.

: Cloudsmith’s network offers high-speed, dependable distribution, allowing organizations to focus on engagement rather than infrastructure.

In a world where developer experience matters, Cloudsmith’s Broadcasts provides a powerful, flexible solution that simplifies software distribution, enhances brand presence, and delivers actionable insights.

Experience the future of artifact distribution with Cloudsmith Broadcasts. See firsthand how you can take control of your software delivery, personalize the experience for your end users, and gain powerful insights into your distribution channels. Schedule a personalized demo with one of our experts to explore how Broadcasts can elevate your organization’s developer engagement and streamline artifact management.

 and transform your software distribution with Cloudsmith.

Paul May

Senior Director, Product & Customer Experience

Elevating Software Distribution with Cloudsmith’s Broadcasts

As containerized environments evolve, effective artifact management is crucial for any organization using Kubernetes or similar ecosystems. Cloudsmith’s container registry now fully complies with the Open Container Initiative (OCI) distribution specification, allowing customers to store, secure, and distribute images and artifacts with greater efficiency.

This release marks an evolution in how Cloudsmith supports organizations, enabling streamlined workflows while ensuring compatibility with current and future industry standards.

With this update, Cloudsmith offers robust support for the OCI storage protocol and API format, including:

: Cloudsmith now supports the OCI storage protocol and API format, bringing greater flexibility and alignment with industry standards for artifact management.

Early Access for OCI Images and Artifacts

: With early access support, Cloudsmith customers can store, secure, and distribute generic OCI images and artifacts, including Helm V3 charts. Using ORAS, users can push and pull artifacts like SBOMs and attestations, strengthening control over containerized workflows.

: The Referrers API allows you to query an OCI registry for artifacts linked to a specific image or artifact, typically through reference or association. This feature is especially helpful for retrieving metadata such as attestations, SBOMs, signatures, or other security-related artifacts, offering a streamlined way to manage dependencies and related security information.

Key Benefits of Cloudsmith’s OCI-Compliant Registry

With Cloudsmith’s OCI-compliant container registry, organizations can unlock the following advantages:

: Integrate seamlessly with any OCI-compliant tools and services, enabling you to choose the right tools to fit your workflows and achieve optimal outcomes without compatibility issues.

: Rely on industry-standard specifications for container formats and image distribution, providing greater consistency, reliability, and peace of mind as you scale operations.

: As more technologies and ecosystems adopt the OCI specification, Cloudsmith’s platform will continue to support them, ensuring your workflows stay relevant and adaptable.

As we continue expanding support for OCI, expect updates on advanced Helm capabilities and additional security features for all supported artifact types.

Maia Livingstone

Campaign Manager

Securely Store and Distribute OCI Artifacts

As software complexity advances, understanding what’s happening across every part of your software supply chain becomes crucial. You need to see where artifacts are used, how secure they are, and whether they meet compliance standards.

The ability to capture this is known as observability. Observability goes beyond data collection to provide essential insights that help teams understand, troubleshoot, and enhance complex systems. It enables engineers to ask critical questions, anticipate issues, and respond proactively—fostering resilience and reliability.

Overcoming the Challenges of Limited Observability

Without good observability, teams are often left in the dark, relying on incomplete data and reactive troubleshooting when issues arise. This can lead to longer downtime, unexpected costs, and missed security risks, as there’s no clear visibility into where problems occur or why. The lack of insights also makes it harder to anticipate trends, manage resources efficiently, and ensure compliance, ultimately compromising system reliability and customer trust.

Knowing this, we wanted to take a step forward and create a solution that provided a quick turnaround on insights that drive immediate corrective action. As a result, Cloudsmith has launched an advanced observability suite, offering enterprises unparalleled insights into their software supply chain. With a fully redesigned user experience, customers can now make data-driven decisions more effectively, managing artifacts with greater precision and control.

Enhanced Observability for Usage Management

Cloudsmith’s advanced observability features give engineering managers and DevOps teams the insights needed to monitor and manage artifact quality and usage across their systems. These tools are built to handle complex, large-scale environments, helping teams track trends, accurately attribute costs, and proactively address risks—essential for maintaining control over a dynamic software supply chain.

"Cloudsmith's analytics and alerts are instrumental in helping us manage our usage more effectively and plan for increases in demand for software artifacts,...We can catch unexpected spikes in artifact consumption, improving our security posture and avoid usage surprises at the end of the month" Dave Bresci, Senior Manager, SRE, PagerDuty.

Cloudsmith’s new observability suite offers several key features geared to upgrading observability:

: Granular dashboards and reports provide a clear view of consumption patterns over time, enabling informed resource management.

: A centralized dashboard for policy violations, vulnerability data, and license tracking offers a straightforward way to assess and address organizational risks.

: Real-time notifications ensure that critical information on usage and policy adherence reaches the right teams when it’s needed most.

These features equip teams with the context and control required to navigate complex, large-scale environments effectively.

The new suite comes with a fully redesigned user experience, featuring streamlined navigation, enhanced performance, and a data-rich interface packed with deeper insights. Cloudsmith has tailored these improvements to ensure smooth, efficient access to critical data, making it well-suited for large-scale enterprise operations.

With this suite, organizations are empowered to navigate challenges confidently, drive smarter decision-making, and ensure their software supply chain remains both agile and secure.This isn’t just a tool - it’s a strategic advantage.

Unlock the full potential of your software supply chain with Cloudsmith’s advanced observability suite. See firsthand how our powerful analytics and real-time insights can help you optimize artifact usage, anticipate risks, and maintain compliance across your systems. Schedule a demo today to explore how Cloudsmith can give your team the visibility and control needed to drive smarter, data-driven decisions.

 and discover how Cloudsmith’s observability suite can transform your software management process and help you stay ahead of potential issues in your supply chain.

Introducing Cloudsmith’s Advanced Observability Suite for Enterprise Artifact Management

In a rapidly evolving digital environment, organizations across various sectors—including technology firms, financial services, and manufacturing—rely on effective management of software artifacts to secure their software supply chains

The risk of supply chain attacks has intensified, revealing vulnerabilities at every stage of artifact management. Compliance breaches, data leaks, and unvetted code present serious threats, and Cloudsmith aimed to tackle these challenges head-on.

Cloudsmith, renowned for its cloud-native artifact management platform, has introduced the 

—a powerful and flexible policy engine tailored to modern security needs. With the integration of Open Policy Agent (OPA) and Cloudsmith’s search capabilities, the Enterprise Policy Manager allows organizations to define, enforce, and monitor policies across their artifact lifecycle.

The software supply chain faces several pressing security and compliance issues:

: Vulnerabilities in third-party components open doors for attackers, making controlled artifact ingestion vital.

: Increasing regulations demand strict adherence to compliance standards.

: Without enforceable policies, unmanaged access and configurations can increase the risk of incidents.

: Many tools lack flexibility, offering predefined policies that may not address unique security needs.

Cloudsmith’s Solution: Enterprise Policy Manager

Cloudsmith’s Enterprise Policy Manager is a comprehensive solution that serves as a control plane across the entire artifact management lifecycle. Leveraging OPA, the platform enables organizations to implement custom, consistent, and traceable policies, strengthening their security posture.

“Software supply chain attacks are a growing concern,” said Glenn Weinstein, CEO of Cloudsmith. “Our Enterprise Policy Manager provides complete control over software artifact ingestion, access, and delivery, protecting organizations from vulnerabilities, bad actors, and misconfigurations.”

Key Benefits of Enterprise Policy Manager

Cloudsmith’s Enterprise Policy Manager directly addresses these challenges with features that enhance security and simplify policy management:

: Build policies based on any available data or attribute, ensuring they align with specific security and compliance standards.

: Speed up implementation with templates for common use cases, reducing time to achieve a secure software supply chain.

: Safeguard against untrustworthy packages by enriching package data. Cloudsmith integrates multiple data sources for thorough quality and risk analysis.

: Use Cloudsmith’s API to automate policy creation and store policies as code, enabling consistent, observable, and repeatable security practices.

With Enterprise Policy Manager, Cloudsmith empowers organizations to:

: Hosting policies on the artifact management platform offers enterprise-wide policy enforcement, reducing misconfiguration risks.

: OPA-based policies provide a consistent, scalable security posture.

: With clear, automated policies, organizations can confidently maintain compliance and reduce audit burdens.

In a world where supply chain security is paramount, Cloudsmith’s Enterprise Policy Manager provides the flexibility, insights, and automation needed to build a resilient and secure software ecosystem.

Stay ahead of evolving security threats and safeguard your software supply chain with Cloudsmith’s Enterprise Policy Manager. Experience how our flexible policy engine, combined with powerful integrations, helps you enforce security policies, enhance compliance, and protect your organization from vulnerabilities. Schedule a personalized demo to explore how Cloudsmith’s Enterprise Policy Manager can streamline policy management and ensure a more resilient, secure software ecosystem for your team.

 and see how Cloudsmith can help you take control of your software artifacts and mitigate risks across your supply chain.

Introducing Cloudsmith’s Enterprise Policy Manager

KubeCon is almost here, and if this is your first time attending or you’re a seasoned pro, you’re in for a treat! 🎉 Next week, KubeCon will take over Salt Lake City, bringing together the brightest minds in cloud-native tech. Whether you're a developer, engineer, or IT pro, this is 

 event to connect, learn, and discover new tools and solutions that can take your work to the next level.

Here’s your ultimate guide to making the most out of KubeCon - and why you should swing by the Cloudsmith booth while you’re there! 🚀

1. Plan Ahead – Know What You Want to See

KubeCon is huge, with so many talks, workshops, and activities happening at once. It can get a little overwhelming, so it’s a great idea to plan ahead! Check out 

, figure out which sessions or panels are most relevant to your work, and map out your day. Don’t forget to leave some time for the 

—you’ll want to see what all the sponsors have to offer. Here are the talks we are most excited about:

Open Policy Agent (OPA): That's One Small Bump for OPA, but One Giant Leap for Policy as Code

A Developer’s Guide to Securing Your Software Supply Chain

One of the best parts of KubeCon is the opportunity to connect with others in the Kubernetes community! With so many industry experts and passionate peers in one place, it’s a fantastic chance to share stories, learn from one another, and build relationships that could spark future collaborations. To make the most of your networking, start by introducing yourself with a smile—share your name, role, and company, and mention what you’re working on. A great way to keep the conversation going is by asking an open-ended question, like “What session have you found most valuable so far?” or “Are there any Kubernetes trends you’re particularly excited about?” If a speaker’s session resonates with you, approach them afterward and share what you appreciated about their talk—most presenters are happy to dive deeper into the topic. Lastly, swap contact info to keep in touch, whether that’s connecting on LinkedIn or exchanging emails. After the event, follow up with a short message to thank them for the conversation and mention a memorable point you discussed. You never know where these connections might lead, so dive in and enjoy the conversations!

 is packed with the latest tools, solutions, and innovations in the cloud-native space. Take time to walk around and explore. You can find us at stand number K6 in the “Frozen Lake Zone” of the Sponsor Showcase.

We’re excited to meet you at KubeCon! If you’re interested in learning how to simplify your artifact management and streamline your build workflows, we’ve got you covered.

 with us at our booth, and here’s what you’ll get:

 on Thursday, November 12, starting at 7:00 pm! It’s the perfect way to relax, chat with new friends, and wind down after a busy day at the conference.

🎁: The first 10 people who book a meeting with us will get a special Cloudsmith gift: a hat, camper mug, and scarf to keep you cozy in Salt Lake City.

Snag a Limited Edition KubeCon SLC Lego Brick:

 We’re bringing 300 KubeCon SLC <> Cloudsmith Lego Bricks - stop by to grab yours before they are all gone!

 You’ll walk away with some great insights into how Cloudsmith can help you:

 🔒: Manage all your software—dependencies, open-source packages, container images, and more—in one easy-to-use platform.

 🔐: How Cloudsmith’s data-driven policy engine ensures your software supply chain is secure and compliant.

 🌍: Deliver software at cloud-native speeds, no matter where your teams or customers are.

5. AprèsKube – The Party You Don’t Want to Miss

After a long day of learning and networking, it’s time to let loose! Join us for 

, our exclusive afterparty on Thursday, November 12 starting at 7:00 pm. With your 

, you can skip the line and head straight into the fun. Grab a bite, relax, and keep the conversation going with other attendees.

Don’t forget to book your meeting with us now

—and get ready to take your software management to the next level. ✨

: You’ll be walking around a lot, so comfort is key!

: KubeCon is action-packed, so make sure you drink plenty of water and grab a snack when you need to recharge.

Power outlets are hard to find in large expo centers. Remember to bring your phone's portable charger so you never run out of battery!

We can’t wait to meet you in Salt Lake City! Let’s connect and talk about how Cloudsmith can help you streamline your software management.

Your Ultimate KubeCon Guide

OpenID Connect (OIDC) provides ephemeral tokens, reducing the risk of long-lived credentials being exposed. For many organizations, artifact management tokens are among the most widely used credentials, making them a significant target for security breaches.

Shifting to OIDC is an excellent way to strengthen security posture, offering substantial benefits with minimal implementation effort. While direct 

Dependabot integration with OIDC in GitHub Actions isn’t available

, API-based token rotation offers a reliable workaround.

This guide will walk you through configuring GitHub Dependabot to authenticate with Cloudsmith using OIDC. It includes steps for setting up a Cloudsmith service account, configuring OIDC in Cloudsmith, setting up GitHub permissions, and creating a GitHub Actions workflow to dynamically update the Dependabot API key.

Step 1: Create a Service Account in Cloudsmith

 that the service account should be associated with for broader permissions.

Step 2: Configure OIDC Authentication for GitHub Actions in Cloudsmith

: Enter a descriptive name (e.g., GitHub Actions).

: Enter https://token.actions.githubusercontent.com.

 as the required claim for GitHub OIDC tokens to restrict access to your specific GitHub organization.

, select the service account created in Step 1 (Dependabot Service Account).

OIDC setup with GitHub Actions in Cloudsmith

Step 3: Set Up Access Controls in Cloudsmith

 for the repository where you want Dependabot to manage dependencies.

Step 4: Add a Fine-Grained Personal Access Token (PAT) in GitHub for Dependabot

 to the specific repository where you want to use Dependabot.

Add a new secret with the name FINE_GRAINED_PAT and paste the PAT as the value.

Step 5: Create DEP_CLOUDSMITH_API_KEY Secret for Dependabot

, enter a placeholder value (e.g., INITIAL_VALUE or a temporary token from Cloudsmith).

This sets up DEP_CLOUDSMITH_API_KEY as a Dependabot-compatible secret so that the GitHub Action can later overwrite it with an ephemeral OIDC token each time it runs.

The initial value doesn’t need to be valid long-term, as it will be regularly replaced by the OIDC-generated token.

After this initial setup, the GitHub Actions workflow you configured will take over, updating DEP_CLOUDSMITH_API_KEY with each run.

Step 6: Configure the dependabot.yml File

In your GitHub repository, create or update .github/dependabot.yml. The example below uses a Maven repository configuration, but this works with other package ecosystems, including npm, pip, and more (see the Dependabot configuration guide for details).:

Replace YOUR-ORG and YOUR-REPO with your actual Cloudsmith organization and repository details. This configuration will enable Dependabot to connect to Cloudsmith for dependency updates.

Step 7: Set Up a GitHub Action Workflow to Overwrite the Dependabot API Key with an Ephemeral OIDC Token

This workflow will authenticate with Cloudsmith via OIDC, generate a short-lived token, and overwrite the DEP_CLOUDSMITH_API_KEY used by Dependabot. Given that Cloudsmith’s OIDC tokens expire every 2 hours, this example schedules token rotation every 11 hours to align with Dependabot’s run schedule. If your setup requires more frequent rotations or encounters token expiration issues, adjust the schedule accordingly.

In your repository, create a file at .github/workflows/update-cloudsmith-key.yml.

Replace YOUR-ORG with your Cloudsmith organization slug.

Replace YOUR-SERVICE-SLUG with the slug of the Cloudsmith service account created earlier.

This workflow uses OIDC to obtain a JWT from Cloudsmith, overwriting the DEP_CLOUDSMITH_API_KEY Dependabot secret with an ephemeral, short-lived token.

 in your GitHub repository and manually run the workflow.

Ensure Dependabot is fetching updates from Cloudsmith and creating pull requests as expected.

This setup allows Dependabot to use a short-lived Cloudsmith OIDC token, enhancing security by overwriting the DEP_CLOUDSMITH_API_KEY secret with each token request.

Next: Learn how to leverage Cloudsmith with Dependabot to streamline your dependency management 

Ciara Carey

Solutions Engineer

Integrating Dependabot with Cloudsmith Using OIDC

 is a modern CI/CD platform designed for Kubernetes and microservices applications. It provides developers with fast, powerful pipelines and deep integration with Kubernetes. The platform’s features, such as enhanced caching, parallelization, and flexible triggers, allow teams to optimize their continuous integration workflows.

 to offer a comprehensive GitOps platform for Kubernetes. GitOps helps teams automate their infrastructure and application management, using Git as the single source of truth for deployments. By leveraging Argo within Codefresh, developers can employ advanced deployment strategies such as canary releases and blue-green deployments, improving release quality and reducing risks.

Benefits of Using Codefresh and Cloudsmith Together

, a cloud-native artifact management platform, with 

 enhances your CI/CD workflows in several significant ways. This powerful combination automates artifact handling, simplifies deployments, and enables the adoption of GitOps practices for Kubernetes deployments.

By automating artifact publishing within Codefresh pipelines, developers can significantly reduce manual steps, minimizing errors and ensuring artifacts are securely available for deployment. Cloudsmith’s support for multiformat repositories ensures that microservices using different package formats—such as Docker, npm, Helm, and Maven—can be managed and retrieved consistently.

Integrating Cloudsmith with Codefresh streamlines deployment processes by allowing developers to pull artifacts directly into their Codefresh pipelines. Whether deploying Docker images or Helm charts, this integration ensures consistency across all environments, from development to production, reducing deployment discrepancies.

, developers can ensure that only approved and secure components are used in their pipelines. Features like quarantine and upstream proxying add further control over unapproved or vulnerable dependencies. This guarantees a secure, compliant software supply chain.

Adopting GitOps for Kubernetes Deployments

Combining Cloudsmith and Codefresh enables teams to fully adopt GitOps practices for Kubernetes deployments. GitOps ensures that deployments are automated and aligned with the desired state defined in Git repositories. With Argo built into Codefresh, continuous reconciliation of your Kubernetes clusters keeps your infrastructure consistent with what’s declared in your codebase.

By integrating these platforms, you automate artifact handling, simplify deployments, and enhance security—all while adopting GitOps practices for Kubernetes deployments. This empowers your team to focus on delivering value—writing code, innovating features, and improving products—while the integration handles the complexities of artifact management and deployment.

How to Set Up a Pipeline with Codefresh and Cloudsmith

Setting up a CI/CD pipeline that integrates Codefresh and Cloudsmith is straightforward. Below is a guide to configure your pipeline for seamless artifact management and deployment using either 

 and create repositories for your artifacts.

: Ensure you have access to a Kubernetes cluster connected to Codefresh for deployments.

Open your Codefresh pipeline and go to the 

Name the variable (e.g., CLOUDSMITH_API_KEY), input your API key, and toggle 

Reference the API key in your pipeline YAML using ${{CLOUDSMITH_API_KEY}}.

 in Cloudsmith (required for OIDC to work with Cloudsmith).

Claims: For example add your Codefresh account ID to restrict access. For more information on claims consult the 

Assign the service account you created earlier.

In Codefresh, set up OIDC authentication by configuring your pipeline to request OIDC tokens during execution.

Add steps in your pipeline YAML to obtain and use the OIDC token for authenticating with Cloudsmith.

Modify your pipeline YAML to include steps that push build artifacts to Cloudsmith after successful builds.

To publish Helm charts, you need to use the Cloudsmith CLI. Ensure that the CLI is installed in your pipeline environment. For more details, refer to the Cloudsmith Helm documentation.

Deploying Artifacts from Cloudsmith Using Codefresh

Codefresh offers several ways to deploy your Docker images and Helm charts to your Kubernetes cluster using artifacts stored in Cloudsmith:

Using the Codefresh GUI to Deploy on Demand

: Choose Docker images from your connected Cloudsmith Docker registry.

: Select Helm charts from your added Cloudsmith Helm repository.

: Use Docker images stored in Cloudsmith within your pipeline steps.

: Utilize the Helm step in your pipeline to deploy charts from your Cloudsmith Helm repository.

Kubernetes Templating (cf-deploy-kubernetes)

: Employ templated deployments for consistent configurations.

: Execute custom kubectl commands within your pipeline, referencing artifacts from Cloudsmith.

: Directly deploy Helm charts to your Kubernetes clusters.

: For advanced GitOps deployments, integrate 

 with Codefresh. This allows automated deployment of applications to Kubernetes clusters using Cloudsmith as your artifact source.

Example of Pulling a Docker Image Using OIDC

Below is an example pipeline demonstrating how to authenticate with Cloudsmith using OIDC and deploy a Docker image:

: Retrieves an OIDC token required for authentication.

: Uses the OIDC token to obtain a Cloudsmith-specific token.

: Logs into the Cloudsmith Docker registry using the obtained OIDC token and pulls the desired Docker image.

: Verifies the successful pull by checking the Docker image's history.

Cloudsmith Blog

Elevating Software Distribution with Cloudsmith’s Broadcasts

Securely Store and Distribute OCI Artifacts

Introducing Cloudsmith’s Advanced Observability Suite for Enterprise Artifact Management

Introducing Cloudsmith’s Enterprise Policy Manager

Your Ultimate KubeCon Guide

Integrating Dependabot with Cloudsmith Using OIDC

GitOps Pipelines with Codefresh and Cloudsmith

"Cloud Native" - Why it matters?

What happens when you upload a Package?

Cloudsmith is headed to Salt Lake City for KubeCon North America 2024

How to Manage Your Package Promotion Workflows with Cloudsmith

Level up your private npm registries in Deno with Cloudsmith