Every business, from startups to established enterprises, feels the urgency to scale their software delivery. Why? Because scaling ensures that as a business grows, its software delivery mechanisms can handle increased demands without compromising on quality or speed. A fast delivery cycle is especially crucial for businesses that experience spikes in traffic, and they must respond to user needs promptly, ensuring timely assistance and resolution.

However, scaling isn't just about handling increased demand. It's about agility, security, and efficiency. Businesses that can't scale effectively risk security breaches, delayed product launches, and operational inefficiencies.

Let’s take a look at some of the challenges behind scaling software delivery, best practices when it comes to scaling, and see how Cloudsmith stands out as first-in-class as an industry leader.

Continuous Delivery (CD) is a culmination of years of refining software development practices. It's not just a methodology; it's a culture. From the days of the Waterfall model, where software development was linear and often rigid, to the Agile era, where flexibility and adaptability became the focus, we've come a long way. CD takes it a step further. It's about ensuring that software is always in a deployable state.

This adaptability means businesses can swiftly respond to market changes, customer feedback, or any unforeseen challenges. The essence of CD is to reduce the gap between development and deployment, ensuring a seamless flow of software updates to the end-users.

Scaling software delivery is like preparing a business for growth spurts. It's about foresight and readiness. When software delivery is scaled effectively:

: Businesses can roll out features or fixes in response to market trends or demands swiftly. This agility can be a competitive advantage, allowing companies to stay ahead of the curve.

: With frequent updates and improvements, customers feel heard and valued. It leads to better user experiences and can significantly boost brand loyalty.

: A faster time-to-market means businesses can tap into new revenue streams quicker than competitors. Whether it's a new feature that users are willing to pay for or an entirely new product line, scaling ensures that businesses are always ready to monetize their innovations.

Challenges in Delivering Software at Scale

Of course nothing in life comes without its hurdles, and scaling software delivery isn’t any different. The following are some common issues that companies face everywhere:

 An inefficient system can push developers to the brink. Imagine a critical bug discovered just before a major release. The pressure to troubleshoot and rectify before the deadline can be immense, leading to overworked and stressed developers.

: In the rush to deliver, teams might opt for quick fixes. These "band-aid" solutions might address the immediate issue but can accumulate as technical debt, leading to bigger problems down the line.

: Speed should never come at the cost of quality. Yet, some teams, in their bid to release rapidly, might overlook crucial quality checks, leading to sub-par software releases.

: Every software release carries a degree of unpredictability. Without a robust system in place, these releases can lead to increased production costs, missed deadlines, and more.

 Errors in the production environment can have dire consequences. From minor glitches to major system crashes, production failures can erode user trust and impact the bottom line.

: Manual monitoring in a high-velocity release environment can lead to increased turnaround times for error resolution.

: Inefficient scaling can slow down product launches, depriving businesses of potential revenue and competitive advantage.


Leveraging Cloudsmith for DevOps Excellence

In the quest to scale software delivery, the tools and platforms you choose play a pivotal role. Cloudsmith emerges as a comprehensive solution, addressing multiple facets of the DevOps journey.

At the heart of any successful DevOps initiative is a culture that allows for collaboration and knowledge sharing. Cloudsmith enhances the developer experience throughout the software development lifecycle. When developers are deeply invested in their work, the entire software delivery process benefits.

Prioritizing security in Continuous Delivery cannot be an afterthought, and it certainly isn’t for Cloudsmith. The platform’s universal, cloud-native solution ensures robust software artifact management and supply chain security. From automated security configurations to tools that detect vulnerabilities, Cloudsmith ensures that security remains front and center.

Simplifying your tech stack is one of the most beneficial things you can do for your organization and team as a whole. Cloudsmith offers a multifunctional platform that streamlines the technology stack, allowing businesses to focus on one comprehensive solution that meets multiple needs, without compromising on quality, security, or control.

Scaling software delivery is a journey, one filled with challenges but also immense opportunities. With Cloudsmith as your partner, businesses can navigate this journey with confidence, ensuring that their software delivery processes are agile, secure, and efficient. After all, building products doesn’t really have an ‘end’— we are constantly learning, evolving, and expanding our knowledge of how to build great products. But with precision and purpose, we can build products that truly matter.

Lee Skillen

Chief Technology Officer

Scaling Software Delivery: Continuous Delivery, Overcoming Challenges, and the Power of Cloudsmith

Efficiency and organization are key when it comes to 

. As teams work to deliver high-quality software at an increasingly fast pace, the need for effective management of the various components of the software development lifecycle has become paramount. One aspect of this lifecycle that often gets overlooked, but is crucial to the smooth functioning of the development process, is artifact management.

Let’s explore artifact management, what it means for you as a developer, why it's an essential part of your toolkit, and the numerous benefits it can bring to your software development process.

Artifact management refers to the process of storing, versioning, and tracking binary files, or "artifacts," that are produced during the software development process. These artifacts can include compiled source code, libraries, and documentation, including operating packages, NPM and Maven packages (or container images like Docker.) The goal of artifact management is to ensure that these files are stored in a secure, organized, and accessible manner, enabling developers to retrieve and deploy them as needed.

Artifact management is about creating a systematic approach to handle the various outputs of your software development lifecycle. It's like a library for your software components, where each artifact is a book that needs to be properly cataloged, stored, and made available for future reference.

Devops entail a set of practices that aims to shorten the system development life cycle and provide continuous delivery with high software quality. In this context, artifact management plays a vital role in maintaining the speed, efficiency, and reliability of the software development and deployment process.

In a DevOps environment, the rapid, continuous development and deployment of software can generate a large number of artifacts. Without a proper management system, these artifacts can become disorganized and difficult to track, slowing down the development process and increasing the risk of errors or security breaches.

Artifact management tools help to address these challenges by providing a centralized repository for storing and tracking artifacts. This not only helps to keep the artifacts organized, but also makes it easier for developers to find and deploy the correct versions of the artifacts they need.

These types of tools can provide additional features such as access control, versioning, and metadata management, which can further enhance the efficiency and reliability of the software development process.


10 Benefits of using an Artifact Management Platform

Artifact management systems provide robust controls for managing the flow of artifacts, including features for promoting, rolling back, and deploying packages. This gives you the ability to manage your software components in a structured and organized manner, ensuring that only the correct versions are deployed.

These systems offer a comprehensive view of your artifacts, including their names, versions, types, and metadata, helping you to keep track of your assets. This visibility is crucial for maintaining an overview of your software components and understanding their interdependencies.

Artifact repository tools can support multiple packaging technologies and provide APIs for easy manipulation, enhancing interoperability and flexibility. This means that regardless of the technology stack you're using, you can manage all your artifacts in a single, unified system. (Think of this like normalising the experience across multiple artifacts types/formats, kind of like bringing order to chaos!)

These systems are designed to be secure by default, providing features such as encryption in transit and at rest, digital signing, and permission management. This helps to protect your software components from unauthorized access and tampering, ensuring the integrity of your software.

Artifact management systems provide metadata for tracking the history and dependencies of your artifacts, enhancing accountability and reproducibility. This traceability is crucial for understanding the evolution of your software components and for troubleshooting issues that may arise.

These systems provide access logs and metrics for tracking the usage of your artifacts, helping you to monitor and optimize your operations. This auditing capability is crucial for maintaining accountability and for understanding how your software components are being used.

Artifact management systems offer fast, global distribution of your artifacts, helping to speed up the development and deployment process. This can significantly reduce the time it takes to get your software to market, giving you a competitive advantage.

These systems can provide a layer of redundancy for public services, ensuring that you can access your artifacts even if the public service is down. This availability is crucial for maintaining the continuity of your operations and for ensuring that you can deliver your software on time.

Artifact management systems support collaboration by allowing you to synchronize workflows and processes within distributed teams. This can enhance the efficiency of your operations and foster a culture of shared responsibility and teamwork.

Using an artifact management system can be more cost-effective than building and maintaining your own system, freeing up resources for you to focus on your core product. This can help you reduce costs, increase productivity, and deliver better software.

Artifact management is a crucial element of modern DevOps practices and software development workflows. By leveraging a dedicated artifact management platform, you can streamline development, ensure security, and improve software quality across the board.

Whether you're managing NPM packages, Docker containers, or custom binaries, implementing a robust artifact repository helps you build a faster, more resilient, and cost-effective artifact software development process.

1. What is artifact management in DevOps?

Artifact management in DevOps refers to storing, tracking, and deploying build artifacts securely and efficiently.

Artifact management ensures version control, traceability, and secure distribution in the software development lifecycle.

3. What does an artifact management platform do?

Artifact management platform stores, organizes, and secures software artifacts like binaries, containers, and libraries for CI/CD pipelines.

An artifact repository stores and manages software artifacts with metadata, versioning, and access control for developers.

5. Is artifact management useful for small teams?

Absolutely. Even small teams benefit from artifact organisation, faster deployments, and consistent builds.

6. What formats are supported by artifact management platforms?

Platforms like Cloudsmith support Docker, Helm, npm, Maven, PyPI, NuGet, and more.


10 Awesome Benefits of Artifact Management and Why You Need It

You know you need to secure your software supply chain. Everyone’s telling you that these days - your executives, your vendors, even 

. Your organization has an initiative to do so, or maybe they’ve brought in an expert to help you achieve this goal. But hold on a minute - do we have a shared understanding of what a software supply chain is, and what exactly makes it secure?

Hopefully, you were able to join the Linux Foundation webinar Cloudsmith hosted last week with 

. The focus was getting back to the basics of what a software supply chain is, and why it needs to be secure. If you weren’t able to attend, or if you want reference material to share with others, here’s our recap.

The webinar addressed the following topics:

What does a secure software supply chain look like?

What are Cloudsmith and Chainguard doing to help solve this problem?

In the most basic terms, what is a software supply chain?

Simply put, a software supply chain includes 

 everything that contributes to making your product - the source code, dependencies, systems, tooling, environments, processes, and even the users who contribute along the way.

, Developer Relations at Cloudsmith, said that a good analogy for understanding the software supply chain is to look at another industry that also deals with supply chains - manufacturing. The manufacturing industry has a standardized way - a Bill of Materials - to detail all of the inputs into their final product. They need that because they need to ensure they have the materials required to build the physical product and that they have met safety and security standards along the way.

The software industry doesn’t have the same regulatory controls as manufacturing, though. There is no centralized authority ensuring provenance and traceability are enforced (though we may see this in the future). This gap has made space for the rise of many interesting projects designed to help make safety and security so easy, it becomes the default. Projects like Sigstore, The Update Framework, in-toto, and SLSA are just a few examples. We’ll touch more on these projects later in this post.


Why are we securing our supply chains now?

As Dan Lorenc said in the webinar, there have been voices advocating for securing software supply chains for years now. But a handful of events in the last 24 months have caused organizations to wonder why they’ve waited so long to get started.


In the spring of 2020, SolarWinds unknowingly started to send out software updates that contained hacked code. This is the event that really got everyone talking about “software supply chains”.

SolarWinds is an IT management tools company that helps businesses manage their networks, systems, and infrastructure. In early 2020, threat actors found a way into the build system at SolarWinds and managed to add malicious code into one of its products, a performance monitoring platform called Orion. Subsequently, when Orion customers updated their installations, the malicious code was included in the update, giving the threat actors a backdoor they could use to install additional malicious software, exfiltrate sensitive data, or spy on the companies themselves.

Big organizations found themselves impacted - Microsoft and Intel for example. Overnight, everyone was talking about software supply chains and what needed to be done to secure them.


In February 2021, security researcher Alex Birsan 

 were found to be vulnerable to the injection of malicious packages, via public sources, into their software supply chains.

, and it relies on package management software to download the malicious version of a package being used as a dependency. The key is to create an external library with the same name as a private internal library that a particular company uses in its development pipeline. There are then several ways that a package manager can end up accessing the malicious external version of the library.

This incident shows why it is so important to make security so easy, it happens by default. It only takes one developer with a poorly configured system for the malicious library to gain entry to the organization.

Executive Order on Improving the Nation’s Cybersecurity

On May 12, 2021, President Joe Biden issued an executive order to begin creating federal standards for security of the software supply chain. 

The Executive Order on Improving the Nation’s Cybersecurity

 orders the Department of Commerce and the National Telecommunications and Information Administration to publish minimum requirements for a 

 (SBOM). The SBOM is a record of the components and packages used in building software, whether open-source or commercial, intended to help software end-users to analyze vulnerabilities or issues with the licenses.


In February 2022, The National Institute of Standards and Technology released Special Publication (SP) 800-218, 

Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities

. At the start of 2022, the White House brought together government employees, private sector stakeholders, and members of the open-source community to discuss how to improve the security of open-source software and software supply chains. This publication is the result of those discussions, and it recommends a core set of high-level secure software development practices called the SSDF that can be integrated into each SDLC implementation.

Why is this a hard problem for organizations to solve?

One challenge is that open-source software is foundational to software development, and so for an organization to secure their supply chain, they will need all open-source software they use to also be secure. Realistically, open-source code is in every supply chain. Now, it’s important to note that the way to solve this problem 

 to remove open-source software from your supply chain. In fact, open-source software can often be more secure than proprietary software as its widespread use means it’s usually well tested. The challenge is in how to make adhering to security best practices so easy, they are not burdensome for the open-source community to adopt.

Along the same lines, for one organization’s software supply chain to be secure, the supply chain of any vendor they use also needs to be secure. You need provenance from top to bottom. To quote Paddy Carey, Senior Staff Engineer, Cloudsmith, “

.” And if no one is requiring you to adopt secure software development practices, and it’s overly burdensome to do so, what’s your motivation? So again, designing standards, tools, and solutions that make it easy to be secure will be key to the widespread adoption of secure software development practices.

As Dan Lorenc said, it will be slow until the first person adopts these practices, but then we’ll see it ripple across the industry.


First, it’s important to acknowledge that there is no one thing you can do to secure your supply chain. There are many best practices that come together to create a secure software supply chain. But it’s also important not to let that overwhelm you.

One project that is designed to help organizations understand what makes a supply chain secure and provide guidance on how to get started is 

. It’s a security framework, a checklist of standards and controls to secure packages and infrastructure in your organization. And there are SLSA levels - Level 1 is designed to be easy to achieve to help motivate folks to start the process of securing their supply chain.

NIST organizes the Secure Software Development Framework practices into four groups:

: Ensure that the organization’s people, processes, and technology are prepared to perform secure software development.

: Protect all components of the software from tampering and unauthorized access.

: Produce well-secured software with minimal security vulnerabilities in its releases.

: Identify residual vulnerabilities in software releases and respond appropriately to address those vulnerabilities and prevent similar vulnerabilities from occurring in the future.

Both the SLSA framework and NIST’s SSDF are good starting points for organizations on the journey to a secure software supply chain. And if you want the tl;dr on NIST’s SSDF, 

Dan Lorenc read NIST 800-218 so you don’t have to

Chainguard was founded in 2021 with the mission to 

make the software supply chains secure by default

. The team is working on this goal with a strong commitment to open-source projects and communities, and a willingness to take on large-scale industry-wide changes. Some key projects they are involved in:

As mentioned earlier, SLSA is a checklist of standards and controls to secure packages and infrastructure within an organization. SLSA levels are a common language to talk about how secure software, supply chains, and their components really are. From source to system, the levels blend together best practices to create four compliance levels of increasing assurance.

A new standard for signing, verifying, and protecting software, sigstore automates how you digitally sign and check components, for a safer chain of custody tracing software back to the source, removing the effort, time, and risk of error this usually comes with this.

As Dan McKinney said, Cloudsmith is excited that securing the software supply chain is now at the forefront of people’s minds, as it’s been close to our hearts for a while now. We believe that 

 - the strategy of ensuring all packages produced or consumed are scanned, verified and isolated from untrusted sources - improves security through isolation, automation, and universal hosting. Our platform enables organizations to add continuous packaging to their modern software development workflow.

Provide a single source of truth of software assets

 with support for over 28 formats, allowing organizations to manage packages across languages and formats in one place. This centralized source of truth provides visibility, control and management consistently for all packages produced or consumed by the build process, and gives organizations a single checkpoint that all packages pass through.

The goal of provenance is an unbroken chain of traceability, all the way back to the host machine that built the package. And we want to meet our users where they are when it comes to provenance. We will implement support for the signatures and attestations that our customers are adopting across all the formats we support, including but not limited to sigstore, cosign, in-toto, The Update Framework and more.

users can cache their open-source packages

 away from public upstreams. By caching packages from public upstream repositories and other external sources, you can protect yourself from issues with package availability, license changes, and emerging vulnerabilities.

First and foremost, we must acknowledge that we are a chain in our customers’ software supply chains. We are taking steps to ensure that we employ high-level secure software development practices, and exposing that information to our customers to prove to them that we are secure. Customers need to be able to trust, and verify, that their providers are securing their software supply chains, too.

Hopefully, that helps demystify software supply chains and why securing them is paramount to the software industry as a whole, and why the time to do so is now.

We’d also like to thank Dan Lorenc, the founder and CEO of Chainguard for joining us for the webinar.

Dan McKinney

Solutions Engineer

Everything You Wanted To Know About Securing The Software Supply Chain

Continuous Packaging (CP) is a term that we have coined here at Cloudsmith, and it is one that we think will become a cornerstone in a secure software development process.

Cloudsmith's Ciara Carey and Dan McKinney have partnered with O'Reilly to introduce the world to Continuous Packaging (CP), and how teams can implement CP into their software supply chains.

Explore the current state of software supply chains.

How developers can identify risks in their own supply chain.

Why CP is critical to secure CI/CD pipelines.

Otherwise, continue reading below to discover the fundamentals of Continuous Packaging!

When you think of modern software development workflows, you typically think of DevOps – and that involves continuous integration (CI) processes and continuous deployment or continuous delivery processes (CD).

These processes evolved to accelerate and improve the task of developing and delivering software at scale. They provide increased velocity, reliability and security through automation, controls and closing the gap between development and operations. Software isn’t “thrown over the fence” anymore when it goes into production. The process is end-to-end, from development right through to deployment or delivery.

As an industry, the adoption of modern DevOps processes like this has brought with it great rewards. Companies can grow faster, ship quicker, delivery of updates can be streamlined, and any issues, bugs or problems can be addressed with less delay.

Not quite! Let’s roll back a bit to the beginning.

Typically, you start with your source codebase. Your CI processes take this and build it into a set of artifacts, images or packages that your CD processes can then deploy to infrastructure or deliver to your customers.

So, there is something that CI and CD have in common, and that is software artifacts, images, or packages. These are the output of CI processes and the input for CD processes.

And this is where continuous packaging comes in. We see CP as a glue layer that sits between and overlaps CI and CD. To build secure software development pipelines using a DevOps methodology, you need the ability to universally store and deliver packages securely and efficiently across all package formats and languages.

It’s unlikely that you would use multiple source control tools or multiple CI or CD tools. You settle on the best-in-class tool for the task, and package management needs to be the same. CP should be a checkpoint - a layer that all packages, images, and artifacts used in and produced from your build processes and your deployments need to pass through. That layer is what empowers you and provides you with the control and visibility that you need.

And that is what it comes down to - At its core:

Continuous Packaging gives your teams security, control, visibility and management over incoming and built assets.

There is an ever-increasing focus on software supply chain security, and rightly so. Recent events have shown that attacks on the software supply chain are fast becoming the number one method that threat actors are employing to breach organizations and users’ security.

And why is this? Well, it’s because it’s a highly effective way to get malicious software distributed to many targets. These targets are increasingly aware of traditional attacks and have been educated to defend against them. What better way to gain entry to a target than through a legitimate update mechanism from a vendor or through a compromised software package that gets used in a build?

Software supply chain attacks manipulate the trust that users and companies place in vendors and the trust that developers place in code that they import or use from public registries and repositories.

So how exactly does CP provide you with that security, control, visibility and management? Well, to break things down a bit further, some of the key benefits of CP are:

Isolation – which gives you control and visibility

Provenance – Which provides you with security via a chain of trust

Acceleration – Which gives you low latency performance for your teams

Provenance is the ability to verifiably prove, using things like package checksums and cryptographic signatures, that software assets are what they say they are and are from who they say they are.

Continuous packaging is about providing a verifiable “Single Source of Truth” for all packages, images, or artifacts consumed or produced during your CI processes. It helps you protect your users and customers by building and shipping clean software only.

Up until now, at Deploy time, there are additional steps when pulling in other dependencies – there is a hole in the provenance chain, a gap to be filled, and having that single source of truth closes that gap.

It’s generally accepted that a lot of the software you run is built by someone else; it’s open-source or built on open source.

It’s a widespread practice in software development to use and depend on public packages - packages from a public repository and by connecting directly to a public repository, you open the door to possible attacks. This has already been demonstrated as an attack vector through Dependency Confusion attacks and the Codecov breach.

Continuous Packaging gives you a protective layer between your teams and public repositories; it defines isolation as the ability to cache packages away from public upstreams. Just some of the benefits this provides are:

- You control package availability. In the event an upstream becomes unavailable, you can continue to build and deploy.

- Protection from Vulnerabilities. If a vulnerability appears in a new version of a package, you have previous versions you may be able to roll back.

- License Management. If a Licence changes, you have the current version, same licence, no immediate impact, gives you time to prepare.

Now, these upstream packages are held in your environment, which brings them under your control. They can form the backbone of your software bill of materials. It provides security teams with an overall view of how packages get used, where they come from and where they are deployed.

We now live in a remote-first, distributed world. Development teams are more distributed than ever before. And not just teams, individual team members are now distributed. Development, Operations, Security – these are all now work-from-home jobs, if not all of the time, then a lot of the time.

So now, more than ever, we need tools that promote strong collaboration and provide a uniform experience - no matter where in the world you are located.

Package Management is a very chatty interface from client tooling running on local machines or build hosts, to package repositories on servers located elsewhere. There is a real need to reduce and minimise the communication times between where you, or your distributed infrastructure, are located and where the artifacts reside.

So, the task is to implement package management globally, providing every team and team member with an optimal, normalized experience. And you need this while also providing universal support for all the artifact types and formats you use. No small task!

At Cloudsmith, we developed what we call the Package Delivery Network, or PDN. It’s like a highly customised version of a CDN because it’s more intelligent and more context-aware. It knows that it deals with packages, software artifacts, and client package management tooling and is built specifically for software distribution, not general content distribution, at the edge.

A PDN means that whatever your team’s location, they all get the same low latency experience. There is no optimal site or location. This helps to foster that collaboration and facilitates the distributed nature of software development today.

Well, there is good news here. You have probably already started!

If you're still curious on uncovering more about CP, download our report: 

 which covers everything you need to know about CP, and how to start implementing it in your organization today.

Package management is the core component of Continuous Packaging, and you are likely doing this in some form already. Even if you don’t have a fully automated CI / CD pipeline in place just yet, developers will be pulling packages from repositories and creating packages when building (even locally).

What is essential is to bring all this together with a single source for software artifacts, a source that you control. You should employ a best-in-class, cloud-native tool for package management, one that provides 

, controls and availability, so that you can realise the benefits of Continuous Packaging.

Cloudsmith is the most cloud-native, universal package management service on the planet, but don't just take our word for it.

, and experience the benefits of introducing Continuous Packaging into your CI / CD pipeline.

Your development teams, security teams and perhaps most importantly your customers, will thank you for it.

Getting Started with Continuous Packaging

Video games are not just computer programs, they are audio-visual artistic works. It’s a collaborative effort between software engineers, animators, scriptwriters, graphic designers, photographers and sound engineers.

Working with these collaborators and assets leads to a different software pipeline than the average software project. They also have the added complication of making cross-platform games - custom optimizations for a particular platform can have the unwelcome side effect of increasing build times and complicating the build process. But when it comes down to it, it’s still a software pipeline that needs a package repository to store its artifacts.

On top of storing their artifacts, gaming developers need a package management tool that helps secure their software supply chain. Protecting and understanding the threats from the software supply chain aren’t new concepts in gaming development by any means. For years, Anti-cheat game developers have been developing ways to protect their supply chain with signed firmware to combat mods, anti-debugging software to defer piracy and hackers, and runtime integrity checks to combat cheaters.

A somewhat new avenue of attack from the supply chain is 3rd party dependencies. Gaming developers should be able to assess and manage their dependencies easily. Like other software pipelines, trust in dependencies is integral to the security of their software. Some gaming software, such as anti-cheat software, can often run at a very high privilege level - the consequences of adding a dependency with a vulnerability could be catastrophic.


Gaming developers need their package management solution to:

Store all their artifacts and have native support for the formats that are popular in gaming development such as Unity, NuGet, Lua, Maven, raw files for binaries, Docker, Helm and packages for mobile platforms like Cocoapods and Kotlin.

Be easy to automate against with APIs, CLIs, Webhooks, Integrations with other DevOps tools and good documentation

Support hosting large files like 3D models, visual or audio assets.

Help them manage the licenses of the dependencies they use.

Help them visualize, control and secure their supply chain including their 3rd party dependancies.

Allow them to work with distributed teams.

A gaming development pipeline builds a video game from concept to completion. These pipelines have to cope with cross-platform builds, audiovisual assets, licensing, different revisions, and creative changes. They also need to contend with a distributed workforce and the security of their software supply chain. Needless to say, Gaming development has quite a complex and time-consuming software pipeline.

Cross-Platform game development allows you to code once and release to all platforms, whether mobile, console, PC, AR, or cloud gaming platforms. The big gaming platforms include Steam, PlayStation, Xbox, Nintendo, PC, Mac, iOS, and Android.

Cross-platform game development can be made more accessible with gaming engines and SDKs. The big gaming engines are Unreal and Unity (see the table below for more examples and information).

Although gaming engines reduce the amount of code that needs to be reimplemented, games often need to add custom changes for things like input control, or they may want to improve the performance on specific platforms. Custom changes to optimize the game’s performance tend to have a negative impact on the build time. For example, two hours of lead time for building a game is normal in game development.

What Gaming Developers Need from their Package Management Tool

The gaming engine and the platform it is running on are the main determinants of what package format your package manager needs to support.

 to host the packages they produce and consume as dependencies. Their package repository needs to support package formats such as NuGet, Unity, Lua, Maven, Conan, raw files for binaries, Docker, Helm and packages for mobile platforms like Cocoapods and Kotlin.

With support for 28 different package formats and counting, Cloudsmith strives to support all package formats for gaming and beyond.

One thing that differentiates game development from other types of software development is the interaction with 3D models, visual assets and audio assets - these tend to be big hefty files.

GIT limits the size of files you can track in regular Git repositories and encourages you to use Git-lfs and replace the binary files with a text-based pointer to where the actual file is hosted. Plastic SCM is another way to version and store large raw assets.

Cloudsmith suggests another solution, you host your files on Cloudsmith as a raw file format, and you can refer to it in your codebase. Bring all your assets into Cloudsmith, where you can visualize, manage and control the access to the assets.

Licensing is insanely important in gaming. One case from 2014 between Epic Games and Silicon Knights resulted in a $9.2million award to Epic Games and an order to destroy all unsold copies of Silicon Knight’s games using Unreal Engine 3. It inevitably led to the dismantling of Silicon Knights.

Gaming publishers use middleware software and gaming engines to build their games. They use these dependencies to model textures, create characters, physics engines, or anything to make building a game faster and more reliable. These dependencies are then distributed with licenses that describe how you can use the software.

It’s essential for Gaming developers and publishers to know and review your license agreements and abide by the terms. But your package management solution can help you with this.

Cloudsmith’s License Compliance provides you with an overall view of the state of licenses for the repository as a whole. It gives you at-a-glance statistics on what licenses you are currently using and allows you to edit/change the license associated with a package held within the platform.

Gaming publishers also usually have a EULA (end-user license agreement) that they make you sign before playing the game. Cloudsmith provides the ability for all Raw format files, if enabled, to require an End-User License Agreement (EULA) when a user attempts to download it. You can also add a custom EULA license agreement to your Cloudsmith packages.

Multiformat Repositories and Universal Tagging

Talking to people in gaming, the thing that comes up as a real point of contention in gaming is that every platform is packaged differently- Sony, Nintendo, Microsoft, Steam, Epic- all different. Cross-platform game development means teams need to track and manage binaries for each platform.

Cloudsmith Blog

Scaling Software Delivery: Continuous Delivery, Overcoming Challenges, and the Power of Cloudsmith

10 Awesome Benefits of Artifact Management and Why You Need It

Everything You Wanted To Know About Securing The Software Supply Chain

Getting Started with Continuous Packaging

Package Management for Gaming Software Development

Target, Track and Trace your Vulnerabilities

Integrating a Cloudsmith repository with a Semaphore CI workflow

Integrating a Cloudsmith repository with a Harness CD pipeline

Integrating a Cloudsmith repository with a Drone CI pipeline

Integrating a Cloudsmith repository with a CircleCI pipeline

Integrating a Cloudsmith repository with a GitLab CI/CD Pipeline

Integrating AWS CodeBuild with Cloudsmith Repositories