By submitting this form, you agree to our 

A practical guide to AI artifacts and LLMOps

Securing non-deterministic systems

the artifact management market is up for grabs

. In a hot market, you’re going to see some interesting and not-entirely-logical attacks. And if I could creatively paraphrase 

, it’s hard to get someone to understand something when their company’s success depends on them not understanding it.

I’m thinking about a curious criticism that one of our competitors, JFrog, leveled at us in a 

. They said they spotted some “red flags” about Cloudsmith, the first and most damning being that we are “

packaging [a] competitor’s open source as an enterprise solution,

[s]elling a paid ‘security’ solution that’s little more than a thin UI layer over someone else’s open-source tool.

 and the underlying Trivy DB as one source of software package vulnerability data.)

They stick to this point pretty persistently, saying we are “

charging you for an open-source solution,” 

rely on open source software as [our] SCA solution,

“if Trivy becomes unsupported or compromised, Cloudsmith’s entire SCA capability could suffer, leaving users vulnerable.

JFrog has it wrong on several counts here.

For starters, pretty much every enterprise tool in the last few decades, including 

, is built on foundations of open-source software (OSS). Does this mean we’re all “charging” customers for “packaging” OSS as an “enterprise solution” in some nefarious way? Like most OSS, Trivy DB is “generic by nature,” which leaves room for developers and software vendors to build custom capabilities on top of it. Which is exactly what Cloudsmith has done. If Cloudsmith is wrong for using “generic” OSS, then we’re all wrong.

In accusing Cloudsmith of using a “competitor’s” OSS, they’re referring to Aqua Security. They’re confused on several key points.

First, they’re failing to acknowledge the distinction between the role of a primary OSS maintainer and a commercial vendor. Aqua Security, the company, is the primary maintainer of the Trivy OSS project. It is also the vendor behind Aqua Enterprise, a commercial product that is built around Trivy.

Second, they’ve tellingly assumed that Cloudsmith considers Aqua Security to be a competitor. We very much don’t. We regard Aqua as a complementary solution; we support integration between Cloudsmith and Aqua Security; and we see Cloudsmith as the data plane & control plane for software supply chain security, so customers can process metadata and execute policies based on vulnerabilities identified by Cloudsmith’s scanning process, or sourced from third-party vulnerability data from the likes of Aqua Enterprise or others, or a combination.

 software can “become unsupported.” But that actually tends to be a much bigger risk with commercial software than with OSS. Trivy is published under an Apache 2.0 license. Even if the maintainers stop publishing future versions as open source, the community could fork an older version. We don’t think this will happen, but if it does, Cloudsmith relies on multiple data sources, and we can easily change our mix from time to time. There are numerous other providers of data similar to Trivy’s.

So why is JFrog attacking Cloudsmith so stridently for relying on OSS, like virtually every commercial software company does, and specifically for relying on Trivy? I can only speculate, but JFrog sees its own security product, Xray, as an important revenue source, and they seem to regard Aqua Security, along with other similar companies, as competitors to Xray.

To state the obvious point: of course we embrace open source. 

 about Cloudsmith’s support for OSS projects, and we Cloudsmithers all believe deeply in the power of software reuse via OSS. I’m old enough to remember when reuse was essentially an unsolved problem in software; we never could have envisioned back in the 1990s how OSS would fundamentally change that. The core functionality of our platform helps enterprises everywhere to efficiently and securely manage the thousands of OSS artifacts and dependencies that make up such a large part of any company’s software supply chain.

And to state another obvious point: we’re not just serving up generic OSS and then somehow convincing customers to pay us for it. It’s what Cloudsmith has built on top of OSS that we’re really charging for. Things like our unmatched global cloud-scale infrastructure, our 24x7 service levels, our policy-as-code enterprise policy manager (EPM) that evaluates every package using your company’s risk criteria, our ability to proxy and cache public upstream registries at unmatched performance levels, our artifact synchronization process that performs scanning and metadata enrichment before a package even hits your repository and gets served to CI/CD pipelines or developer IDEs, our stellar customer support, and much more.

Yes, we rely on OSS, and we think that’s a significant strength from which customers benefit.


Glenn Weinstein

Of Course We Embrace Open Source!

Cloudsmith loves open-source software (OSS). There, I said it.

Our co-founders, Alan Carson and Lee Skillen, recognized from the beginning that smart reuse is a core value of the software community. Companies that make developer tools have a special obligation to support OSS, which in the case of Cloudsmith means 

 (OpenSSF). It also means giving back to the community by hosting OSS repositories, and providing distribution capabilities.

 is one of our earliest and most popular features. Any Cloudsmith user - even those on our free Core plan - can create OSS repositories, which we track separately from your public or private repos. OSS repos get 50GB of storage and 200GB of monthly bandwidth for free, as long as you attribute Cloudsmith in your readme. (There are a 

 - specifically, client logging and geo/IP controls - to every OSS repo hosted by Cloudsmith. We recognized that OSS maintainers need these controls, especially as their libraries gain popularity.

 is a wake-up call for software companies. Most commercial software products are built on top of mountains of OSS; and by some estimates, up to 90% of all deployed production code is sourced from an OSS library. There are legitimate questions being asked today about whether commercial entities are doing enough to support the development and maintenance of the OSS that we all rely upon, and ultimately need to trust.

Cloudsmith is a foundational tool in protecting and securing the software supply chain. Organizations large and small use Cloudsmith to ensure they can have a single source of truth, and control the flow of every software ingredient that ultimately lands on their production servers and client devices. The explosion in OSS has demonstrated the need for security-oriented tools like Cloudsmith. While we help customers protect against vulnerabilities that can sneak into OSS, we also believe it’s part of our mission to support healthy development and distribution of OSS.

Like the headline on this blog says - Cloudsmith ♥ OSS.

Cloudsmith ♥ OSS

Cloudsmith proudly introduces support for private Hex package repositories, marking a significant milestone in supply chain security and package management for Erlang and Elixir teams.

With Cloudsmith, you can manage, develop and distribute your Hex packages in your own private Hex registry using familiar tooling, ensuring seamless integration into your existing workflow.

Our fully managed platform provides global distribution for remote teams, with 410 points of presence around the world, ensuring elasticity to scale with your team's needs.

Enjoy peace of mind with built-in security scanning for malware and CVEs, and define how to handle low, medium, and critical issues.

Plus, our transparent pricing makes Cloudsmith affordable for teams of all sizes, and you'll receive quality Engineer led support, ensuring a smooth experience from start to finish.

Hex is a package manager for the BEAM ecosystem; any language that compiles to run on the BEAM VM, such as elixir and Erlang, can be used to build Hex packages.

Hex is an open-source project initiated in early 2014, and continues to evolve under the stewardship of Six Colors AB which was founded in 2018 by Hex's creator, Eric Meadows-Jönsson.

Since its inception, Hex has become indispensable for Erlang and Elixir developers, facilitating dependency management and third-party library integration with ease.

With Cloudsmith's launch of private Hex repositories, developers now have a secure and flexible solution for hosting and distributing Hex packages internally for development or externally for distribution.

Running your private Hex repository on Cloudsmith provides numerous advantages:

 Develop and securely share Hex packages internally and share them privately to other teams anywhere in the world.

 Seamlessly distribute and deploy your organization's Hex packages within CI/CD pipelines.

 Distribute Hex packages globally as commercial software, with granular control over access and distribution.

Mirror public Hex packages and insulate your organization from uncontrolled public upstream.

 Capture the precise state of dependencies at specific versions/releases for improved version control.

 Manage access to Hex packages efficiently with Cloudsmith's comprehensive access management features.

Getting started with Cloudsmith and Hex is straightforward:

and create a repository to host your Hex packages.

Publishing your Hex packages to Cloudsmith

Add Cloudsmith as a repository using the Mix client:

Create your Hex package following standard procedures for building and packaging your Erlang or Elixir project.

Ensure that your Hex package is properly configured and ready for publication. This includes updating the 

 file with the necessary metadata and dependencies. Simply update the 

 with your Cloudsmith repository's URL and authentication details like this:

For detailed setup instructions and integration guidance, refer to 

 or the contextual documentation within your Cloudsmith repository.

Cloudsmith's private Hex repositories provide a robust and flexible solution for managing Hex packages within your organization.

As the only cloud-native, global, and universal artifact management platform designed for secure software development and distribution, Cloudsmith provides the essential security, reliability, and control necessary to secure and streamline package management workflows.

We're extremely proud to be able to support the Erlang and Elixir ecosystems with this first (non-official) implementation of public and private Hex registries.

Start leveraging Cloudsmith today and experience the benefits of hosting your Hex packages in the world's first private Hex repository service.

Cloudsmith Blog

Of Course We Embrace Open Source!

Cloudsmith ♥ OSS

World's First Private Hex Repository with Cloudsmith