By submitting this form, you agree to our 

Edmund, had been promoted to Chief Executive of Elf, Inc. in February, a mere 10 months ago. It had at the time been a great honor, but had almost instantly become a farce. Not only did toy production stop for a number of months, it was now looking like all the toys would remain in storage until such time, Father Christmas would be allowed to deliver them. And who knew when that might be.

The phone rang. Edmund picked up and stoically spoke, “Hallo.”

It was a crazy plan. The elves were to stop all toy production immediately. That was unheard of. Every available toy-making elf had to re-train overnight in software development and related disciplines. That, at least, was possible, elves are extremely adaptable and pick up new information like sponges, and there was a small, but efficient development team that had been building the software for the many electronic toys over the years.

The plan was to build a digital parcel, a package of goodies, for every child who had the means to consume it. Where appropriate it would include video games, e-books, movies, tv boxsets, music, comics, digital trading cards, software, and various digital assets like avatar upgrades and gift cards.

Edmund was horrified at the sheer amount of work involved, this late in the day. He spent hours on a spreadsheet trying to figure out how to achieve this massive undertaking. No matter how often he did the sums, there was no way to build all the packages and the delivery method. They would have to use a third-party to distribute.

He searched for “package distribution” and a few suitable options showed up. After a quick read of each of the offerings feature sets, one stood out, one with enough global infrastructure and scalability to handle such a large distribution all at once.

“This just might work,” he muttered to himself.

Alan Carson

Co-founder and Chief Strategy Officer

Elf Storage and Distribution

Our distinguished competition took a puzzling position of “Imagine there’s no versions”.

At Cloudsmith we think that’s crazy. Software versions are what makes software development possible. They make deployment possible. They make distribution possible. How else can you understand and navigate complex dependency trees or be sure your code will interact with a third party’s? Hint - you can’t!

You must care about versions. And updates. It’s the only way to know you are on the latest build; the one with the security fixes and new features. But it’s not about the end-user. It’s about you. How else can you label or tag the push of a new build that’s been verified?

Not a single one of our customers has ever asked us how to architect, build, and deploy versionless software.

The revolution against versions hasn’t begun - and never will. Versions are here to stay. There is an explosion in the amount of open-source software that all software relies upon, and the only way to manage the chaos is with versioning.

 containers are filled with versioned software. You need to know what’s in each and every layer.

Now more than ever, engineers, like you, and like us, need better tools to track, manage, and understand all software pulled into your stack. Cloudsmith was built to tackle this problem, providing a single source of truth across every format you use; providing isolation from public upstreams, and allowing you to interrogate the provenance of any package with insight into security and licensing. These are vital for everyone going forward.

But more than that, there are three key reasons why versions are so important:

More bluntly - “Knowing what is where”. The dependency tree for any piece of modern software can be vast. You need proper visibility on what packages, libraries and components make up this tree because without it you really are running blind, in more ways than one. Without versions, you don’t have this visibility, and you’re missing the details of the “what”.

Once you know “What is where” you need to explore “When did something change?”. You should be able to trace back when a particular package or library was updated, modified or even rolled back. Without versions, you can’t do any of this - it’s like a financial audit without figures: it’s lacking the very detail that it requires to be effective.

And finally, you need to know “Will this actually work?” You can see what you have, you know when things changed, and now you can determine if the sum of these will, in effect, “make” or “break”. Without versions, you can’t tell. You can’t plan, implement or react effectively. You’re adrift in a sea of unknowns. Breaking changes are real, we have all seen them. This is one of the most important reasons why versions matter.

While we admire the sentiment of imagining a world with no software versions; it’s just not realistic. We fundamentally believe in the opposite; and will continue to build a platform that gives you a more profound understanding of versions; not one that muddies the very clarity you need to develop better, faster, more maintainable products.

Dan McKinney

Solutions Engineer

Infinity Welcomes Careful Versioning

Getting Started with LuaRocks and Cloudsmith

A short demo of how to get started with LuaRocks modules and Cloudsmith, including uploading a LuaRocks module to a private Cloudsmith repository and then downloading and installing it.

https://help.cloudsmith.io/docs/luarocks-repository

At Cloudsmith we love playing video games, everything from Super Meat Boy to Halo, Fortnite to Candy Crush. We’ve got a big Pac Man money box sitting on the office shelf. Steve Collins, of Havok fame, is on our Board of Directors. Quite simply, gaming is in our DNA.

When we started Cloudsmith we made a list of customers we’d love to work with someday and there were numerous games studios on the list. It was a proud moment for the team when the first games company signed up to distribute its software globally. Since then more major studios have followed suit. It’s truly exciting to be a part of the deployment and delivery process for companies we really admire.

We pay homage to a few video game greats with our pop culture banners in our documentation; see 

. Can you guess the games on which each is based?

Cloudsmith can solve many problems for games companies, but what is most unique about a games company is that they are the software companies that can make use of all three of our primary use cases:

The beating heart of any games company is its Intellectual Property. Now, of course, this consists of game characters, themes, and franchises, but it also consists of a lot of proprietary code, libraries and packages, game engine components, and sound and graphic assets. Protecting this IP, while also granting globally distributed internal development teams easy access so that they can work with it is a major challenge. Cloudsmith private repositories allow a games company to centrally manage its software assets, provide secure access for development teams worldwide, and also deliver performant global availability.

A games company requires a lot of infrastructure to operate effectively. Significant resources are required to facilitate both internal development teams and any customer-facing environments for matchmaking and multiplayer services. This may take the shape of on-prem servers or cloud-based environments, but building and managing this infrastructure is a complex task. Even when automated through tools such as Terraform, Ansible, Puppet, Chef, and others, it still requires that these tools have a central source-of-truth for the packages and modules that they require. The universal package support offered by Cloudsmith means that it is easier for internal DevOps teams to manage these builds and deployments.

Games companies often need distribution of software assets and packages for a few different use cases, like distribution of software assets to licensed customers or distribution of packages and libraries to 3rd party development partners. To do this, they require fine-grained control over access, and visibility into download activity and usage. Cloudsmith’s extremely flexible Entitlement Token system allows the creation of unique, read-only access tokens that grant access to specific packages or assets. These tokens can have multiple restrictions attached, such as limiting access to specific packages, for a specific timeframe, from specific locations, and even a maximum number of downloads or bandwidth use. Any read activity on the repository is attributed and associated with an Entitlement Token and therefore users can be precisely monitored and analyzed.

As an example, we’re solving two use-cases for one such customer:

Supporting the management of Debian deployments to their IT infrastructure, including isolating public packages through our recently launched Upstream Proxy & Caching feature,

Enabling the distribution of private core dependencies to their partners, which utilizes our Entitlement token system.

As we mentioned, we love playing video games, and being part of the deployment and delivery process for companies that create them is something we’ll be forever excited about. Whether it’s 

, or the full trifecta, Cloudsmith is here to help support and solve many of the problems games companies face all in one platform.

Don’t just take our word for it though - 

Games are in our DNA

Getting Started with Maven and Cloudsmith

A short demo of how to get started with Maven packages and Cloudsmith, including deploying a Maven package to Cloudsmith and then downloading it as a dependency.

https://help.cloudsmith.io/docs/cran-repository

Custom EULA

It is simple to add a custom End User Licence Agreement for your package downloads in a Cloudsmith repository.


As a vendor, understanding your bandwidth usage is an invaluable insight into how packages are distributed across your user base and how specific users have grown over a timeframe.

As a user base grows from 10s, 100s, and 1000s of users and package downloads are many multiples of your total number of users, it's essential to understand the distribution of your bandwidth utilisation by a user (or more precisely, entitlement token's) to aid in the identification of token's that make up a large percentage of your overall traffic.

When providing an entitlement token to a user under a specific license, you trust an entitlement token will be used to download packages upon the agreed-upon terms. However, an increase in your total bandwidth may start off slow and continuously grow over several months until it's suddenly become a massive increase in your overall bandwidth. Understanding this usage and precisely where this growth originates helps identify where/where change occur and provides options to mitigate runaway bandwidth from specific entitlement tokens by changing how those specific users are managed.

Whenever a user downloads a package from a private repository using an entitlement token, the exact number of bytes transmitted from our servers to the user host is stored for that specific token as an individual log entry. At the end of each day, we calculate the total bandwidth for every user across all of our repositories containing one or more packages and store the result as a daily aggregated value representing bandwidth usage.

The easiest way to get started exploring these metrics is to check out the metrics command within the Cloudsmith CLI. Alternatively, to get more fine-grained metrics, you can implement a programmatic solution using our API or one of the API binding libraries published in various languages.



Using the Cloudsmith CLI you can quickly and easily query the total bandwidth usage for your repository by running the following command with your organisation/repository.

The following screenshot shows an example repository contain a number of active and inactive entitlement tokens alongside the total bandwidth used. The statistics table provides a simple insight into min/max/average token usage.

You can also retrieve usage metrics for one or more specific tokens by providing a comma separated list of Entitlement token (identifiers)

cloudsmith metrics tokens cloudsmith/example --tokens=ZGCV58VqT8Sl

If you wish to drill down further into a specific period of usage for a token, you can supply am epoch timestamp for the 

 parameters to include only usage within that period. In this example, a single token is displayed for all of 2019.

Vendors Rejoice! Analyse your Bandwidth Usage

What software assets does your organization use?

What sounds like a simple question is anything but. If we include every package and dependency that ends up in the code we produce then for most development teams the truthful answer is ‘we don’t know’.

As we’ve said enough times already, that really isn’t good enough anymore. And that’s one of the core motivations behind Cloudsmith. A central private repository provides an ‘isolation layer’ in which everything you use is both stored and controlled.

Cloudsmith is entirely flexible in terms of how repositories are built and structured. Depending on what is convenient for your organization, you can either build universal repositories in which packages in multiple formats sit side-by-side, or format specific repositories.

But our support for transparency around the use of software assets across the entire organization doesn’t stop there.

By providing a single repository for all your assets, Cloudsmith enables you to check at a glance exactly which individuals and processes are downloading those assets. This can be helpful in a number of ways. It certainly is if you need to quickly establish precisely where any given package may have been used in the wake of identifying a specific vulnerability.

Download logs in Cloudsmith, as shown below, mean you have a record of precisely what is being used where, and by who or what. At any moment you have a full audit trail and detailed information relating to every download of every asset, so you can ensure the right people are accessing the right things in the right way.

We also provide event logs along similar lines, so you can keep a handle of any actions against any package within your Cloudsmith environment.

Beyond granular level access logs, Cloudsmith also supports aggregated reporting around access to each individual repository. This includes download and upload counts and associated bandwidth, plus downloads and uploads reported against geolocation, package type and distribution.

This type of reporting has a variety of uses. For one, it helps manage your account with Cloudsmith and ensure total visibility around usage, which in turn can be used to accurately forecast costs. (Cloudsmith also supports the configuration of retention/lifetime rules, meaning you can automatically delete or move packages after a certain amount of time in order to actively control those costs).

Full statistical reporting also provides key insight around which packages and formats are most popular, plus which are trending up or down in terms of usage. This data in turn can help understand where the business is particularly exposed to one package or package type, or alternatively which packages are being stored and rarely used.

All in, we provide a variety of methods for understanding how your repositories, packages and assets are used. All of them support better, more efficient development and distribution.

Auditing and Reporting In Cloudsmith

Getting Started with Composer and Cloudsmith

A quick walkthrough of getting setup with php/Composer and pushing packages to a Cloudsmith repository.

https://help.cloudsmith.io/docs/composer-repository

Managing dependencies is a fact of life in modern software development. But at Cloudsmith, we’re focused on ensuring that the process is as painless as possible.

we’re delighted to announce both upstream proxying and caching for 

. Together they mean simpler, more reliable integration of third party packages into the development process. Better software, faster.

In the simplest terms, upstream proxying means 

Cloudsmith is now your single point of contact for all 

. By proxying upstream dependencies located in Maven Central (the ‘accepted’ central repository for Java packages), Cloudsmith enables your organization, and your build systems, to deal with a single point of contact (us) rather than having to build and manage multiple integrations.

To put that another way, if your build requires any specific dependency, and informs Cloudsmith of that requirement, we will find that dependency upstream and proxy within our platform. This ensures that the dependency is made available to your organization in the same way that every other package, dependency or asset within Cloudsmith is.

This process is completely transparent and controllable to the Cloudsmith customer. You determine ahead of time which repositories you want Cloudsmith to check, and the precedence or priority between them. We also allow our users to specify what to do in the event of upstream failure - whether to retry, and after what period of time.

All in, upstream proxying is one more step in ensuring that dependencies are available when you need them, and available through Cloudsmith: meaning simpler integration and faster builds.

A step further, if you like, is caching. This involves Cloudsmith locating, downloading and storing dependencies within the Cloudsmith environment. So in other words, rather than act as a go-between Cloudsmith does the whole job.

This can have many benefits, but primary among them are:

Guaranteed great performance. Cloudsmith ensures lightning-fast delivery to any location on the globe - not something you can take for granted when integrating packages from public repositories.

Control: storing packages and dependencies within Cloudsmith gives you a greater ability to scan for vulnerabilities, check licensing implications, and monitor where and how packages are used. These things are not possible (or are at least difficult) when integrating straight from public repositories.

Caching gives you all these advantages, but you can still define when Cloudsmith goes looking for a new version of any given package before bringing it into your own private repository, so you lose no control when it comes to precisely how Cloudsmith and Maven Central interact.

Together, these new features bring Cloudsmith closer than ever to our goal: becoming a single source of truth for all the software assets an organization uses. By providing a single integration for all packages and dependencies we greatly improve the reliability and simplicity of development and deployment processes. And by bringing all assets together within the Cloudsmith environment we allow for greater levels of control and security than ever before.

If you want more information on getting started with proxying and caching with Cloudsmith, 

Caching and Upstream Proxying For Maven Packages

As time has progressed, the number of languages, frameworks and packages available has grown to the point where it’s rare nowadays to find a project that is developed entirely in a single language or within a single ecosystem.

A typical project uses the best languages and frameworks for the job, and these frequently differ depending on what part of the project is being developed. And that stands to reason - after all those different languages in most cases exist precisely because they are better suited to some specific tasks rather than others.

When you then bring package management into play, things get more complicated again. If you are using several languages, you’ll have several package managers. That in turn means you’ll require several repositories (Public or Private) and therefore several places that you need to manage, several places that you’ll need to integrate with your build processes, and several places that you’ll have to ensure your team has reliable, performant access to.

It is a universal law of software development that there is more than enough to manage as it currently stands, so adding all that to the pile isn’t a great idea.

At Cloudsmith we believe there is a better way: 

Multi-Tenant Repositories: What Are They?

So what is a Multi-Tenant Repository? Well, in short, it’s ONE PLACE to store and manage your software artifacts and packages - no matter what package formats you are working with.

Yes, that’s right Your Docker images can live right alongside your Python packages or your npm packages. You have one single location to manage.

Furthermore, this one location will play nicely with your 

 tooling. You can just do your usual `docker pull`, `pip install` or `npm install` - all from the one, single repository!

So whilst you have a single repository, and a single set of processes for managing, sharing and controlling your software assets, you lose absolutely nothing when it comes to functionality.

The benefits of multi-tenant repositories aren’t just limited to development environments either.

If you are distributing your software to your own customers, and you provide it in a number of different formats, wouldn’t it be nice (and convenient) to offer all those formats to your customers from a single unified location? Not only does it just work better, it looks better also!

You no longer have to worry about pushing/publishing to multiple different repositories, or keeping them in sync, wondering what was pushed to where - it’s all in the one place. The reduction in overhead here is not to be underestimated.

Now of course, if you want to create a repository for each format that you use then you absolutely can do that - there is nothing about Cloudsmith’s multi-tenant repositories that would prevent you from doing so, if that’s your style and you’re happy with it - or if you work in a single language/ecosystem. The point is that we give you the flexibility to “do it differently” (and just maybe, easier!)

At Cloudsmith, we really believe in automation. And in our experience what helps automation is simplification. Make processes simpler, make them less error-prone, more reliable and more robust: just make them easier to automate!

Multi-Tenant repositories are here to make your lives easier, not harder.

As I said, software engineering is hard enough already! 😊

How Multi-Tenant Repositories Benefit Workflows

Getting Started with Debian packages and Cloudsmith

A short walkthrough of using your private Cloudsmith repository for your Debian packages.

https://help.cloudsmith.io/docs/debian-repository

Cloudsmith Blog