CLI v1.29.0: OIDC for Buildkite and Google Cloud, and listing packages from connected repositories

The Cloudsmith CLI now authenticates from Buildkite pipelines and Google Cloud workloads with OpenID Connect (OIDC), so no Cloudsmith API key needs to live on your build hosts. It can also list packages from connected repositories alongside your own.

Authenticate from Buildkite with OIDC

v1.29.0 adds Buildkite to the CI/CD platforms that the CLI detects automatically. In a Buildkite job, the CLI asks the Buildkite agent for an OIDC token and exchanges it for a short-lived Cloudsmith token.

First, create an OIDC provider in your Cloudsmith workspace with these settings:

• Provider URL: https://agent.buildkite.com
• Required OpenID token claims: organization_slug, set to the slug of your Buildkite organization. Buildkite signs tokens for all organizations with the same keys, so this claim keeps other organizations out. You can add other claims from the token, such as pipeline_slug or build_branch, to limit access further.
• Service accounts: the service account that the pipeline authenticates as.

Then set your workspace and service account in the pipeline:

env:
  CLOUDSMITH_WORKSPACE: "YOUR-WORKSPACE"
  CLOUDSMITH_SERVICE_SLUG: "YOUR-SERVICE-ACCOUNT"

steps:
  - label: "Push package"
    commands:
      - cloudsmith whoami --verbose
      - cloudsmith push FORMAT WORKSPACE/REPOSITORY FILENAME

When authentication succeeds, cloudsmith whoami --verbose shows Authentication Method: OIDC Auto-Discovery and Source: OIDC via Buildkite.

For more details, see Integrating Buildkite in the Cloudsmith documentation.

Authenticate from Google Cloud with OIDC

v1.29.0 also adds automatic detection of OIDC credentials for Google Cloud. On Compute Engine, Google Kubernetes Engine (GKE), Cloud Run, Cloud Run functions, App Engine, and Cloud Build, the CLI gets an ID token for the service account of the workload. It then exchanges the ID token for a short-lived Cloudsmith token. The CLI finds the service account through Application Default Credentials (ADC), which is the same mechanism that the Google Cloud client libraries use.

Create an OIDC provider in your Cloudsmith workspace with https://accounts.google.com as the provider URL. Google signs ID tokens for all Google Cloud projects with the same keys, so add claims that match only your own service accounts:

• One service account: add a sub claim set to the numeric unique ID of the service account. To get the ID, run:

gcloud iam service-accounts describe SERVICE_ACCOUNT_EMAIL --format='value(uniqueId)'

• All service accounts in a project: add an email claim with a wildcard at the start, such as .*@PROJECT_ID.iam.gserviceaccount.com. Keep your project ID in the value. A broader value, such as .*@developer.gserviceaccount.com, also matches service accounts in other Google Cloud projects.

You can add other claims from the token to limit access further.

The CLI supports these credentials:

• Attached service account: the service account of a virtual machine (VM), a Cloud Run service, or a Cloud Build job.
• Service account key: a key file that GOOGLE_APPLICATION_CREDENTIALS points to.
• Service account impersonation: local credentials from gcloud auth application-default login --impersonate-service-account=SERVICE_ACCOUNT_EMAIL. Use them to test the setup from your own machine.

For a step-by-step Cloud Build setup, see Integrating GCP CloudBuild. For all supported credential types, see Google Cloud in the CLI documentation.

List packages from connected repositories

Connected repositories let one repository serve the packages of other repositories. v1.29.0 adds --include-connected to cloudsmith list packages, so you can see these packages from the terminal:

cloudsmith list packages WORKSPACE/REPOSITORY --include-connected

With the flag, the table adds an Origin Repository column that shows the repository each package belongs to. In JSON output (-F json), the origin_repository field has the same information, and is null for packages that belong to the repository you listed. The flag works with -q search queries and the pagination options.

Note: Download URLs in the output, such as cdn_url, point to the repository you listed, not to the repository that the package belongs to.

Connected repositories are in early access. To try them, contact us. For more details, see Connected repositories in the Cloudsmith documentation.

cloudsmith repos list output no longer includes the repository display name

cloudsmith repos list now shows the repository identifier (WORKSPACE/REPOSITORY) in the first column instead of the repository display name. The identifier is the value that other CLI commands accept.

Requirement changes

• The standalone binaries now ship with the Python 3.14 runtime.
• The Python package now requires Python 3.11 or later.

Other improvements

• The new detectors use the existing OIDC controls, with the IDs buildkite and gcp. For example, set CLOUDSMITH_OIDC_GCP_DISABLED=true to skip the Google Cloud detector, or use --oidc-detector-order to change the order in which the CLI tries each platform.

For a more detailed list of changes, see the changelog on GitHub.