The Cloudsmith CLI now ships as a standalone, self-contained binary for Linux, macOS, and Windows. This eliminates its dependency on a local Python environment. The CLI includes a new one-line installer, a refreshed Homebrew tap and Docker image, and updated GitHub Actions, Azure DevOps, and CircleCI integrations.
What’s new
The standalone binary bundles everything it needs at runtime. Installation is now a single download-and-verify step that behaves identically across platforms and CI providers.
Previously, the CLI was distributed primarily as a Python zipapp (cloudsmith.pyz), which requires a compatible Python runtime on any machine and CI runner that uses it. The dependency on a local Python environment often creates extra setup steps, could slow down pipelines, and is susceptible to breaking when the runner's Python version changes.
How it works
For each CLI release, we now publish platform-specific binary archives with SHA-256 checksums, attached to a GitHub release and pushed to Cloudsmith. Linux archives also ship a detached GPG signature.
Platform
Supported architectures
Linux (glibc and musl)
x86_64, aarch64
macOS
arm64, x86_64
Windows
x86_64
The standalone binaries replace the cloudsmith.pyz zipapp, which will be deprecated.
Installation
There are 4 supported installation methods:
Install script: A new installer repository includes install.sh for Linux/macOS and install.ps1 for Windows. The install script detects the platform, downloads the right archive, verifies its SHA-256 checksum, and installs the CLI atomically. Each release also attaches a SHA256SUMS file for verifying the scripts themselves. For reproducible CI builds, pin a specific version instead of latest.
Homebrew: The tap now installs the standalone binary and no longer depends on Python. Existing installs upgrade transparently with brew install cloudsmith-io/cloudsmith-cli/cloudsmith.
Docker: The official cloudsmith/cloudsmith-cli image on Docker Hub now ships the standalone binary on a plain Alpine base.
Pip: If you prefer to run in your own Python environment, you still can do so, via pip install cloudsmith-cli.
Each CI/CD integration for the Cloudsmith CLI now installs the standalone CLI and supports API key and CLI-native OIDC authentication, with no Python or additional dependencies on the runner.
These are major releases with breaking changes. Existing integrations will continue to work normally until you update to v1.20.0.
CI/CD integration
New version
Highlights
GitHub Actions
v3
Composite action; Linux, macOS, and Windows runners with ARM64 support; exposes CLI path and version outputs.
Azure DevOps
@2
Consistent install across Linux, macOS, and Windows agents; existing @1 pipelines keep working until you opt in.
CircleCI orb
3.0.0
Smaller cimg/base default executor; publish with 'cloudsmith push' directly.
For migration steps and examples, see the guide for your integration:
Update tooling to use the cloudsmith/cli repository: Cloudsmith now publishes our CLI artifacts (binaries, Docker images, and Python wheels) to the cli repository. We are deprecating the existing cli-zipapp repository, so you should update any tooling that pulls from the deprecated repository.
Update CI/CD integrations for GitHub Actions, Azure DevOps, and Circle CI orb: The new CI/CD integrations for GitHub Actions, Azure DevOps, and CircleCI orb are major releases with breaking changes. Update your integrations with the migration guide for each.
Remove unused Homebrew dependency: brew upgrade handles the upgrade transition automatically. After upgrading, you may have an orphaned python@3.10 dependency, which you can remove with brew autoremove.
At Cloudsmith, we recognize that security is a team sport. Meaningful improvements to our platform have come from researchers and security professionals who take the time to find issues and report them to us responsibly. Today, we're launching a new bug bounty platform - now live at bounties.cloudsmith.com - built to make it faster, clearer, and more rewarding to submit security-related bugs to Cloudsmith…
The Cloudsmith CLI now eliminates the need for static API keys in CI/CD pipelines by automatically discovering OpenID Connect (OIDC) credentials for all major CI/CD platforms and includes a Docker credential helper to automatically authenticate to Cloudsmith registries…
You can now apply cooldown policies to Maven packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny…
You can now apply cooldown policies to NuGet packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny…
Cloudsmith has joined the GitHub secret scanning partner program. This integration helps prevent unauthorized use of your API keys by automatically detecting exposed keys before they can be exploited…