CLI v1.30.0: Error reporting, TLS-intercepting proxy support, and a username and password login deprecation

The Cloudsmith CLI now sends reports of unexpected errors to Cloudsmith by default, so we can find and fix crashes without waiting for a support ticket. It also connects through Transport Layer Security (TLS) intercepting proxies without turning off certificate verification, and installs credential helpers where package-manager upgrades can't remove them.

Username and password login with cloudsmith login and cloudsmith token is deprecated and stops working on November 20, 2026.

Error reporting

When a command fails with an unexpected error, the CLI sends a report to Cloudsmith through Sentry, an error-tracking service. Error reporting helps us find and fix CLI bugs, including ones nobody reports to support. New reports alert the Cloudsmith CLI team, who triage them as bugs.

Usage errors, such as a missing argument, errors that the Cloudsmith API returns, and failed certificate checks are not reported. Reports aren't linked to you or your account, so for help with a specific problem, contact Cloudsmith support.

A report contains:

• Error details: the exception type, the error message, and the stack trace.
• Command: the command name, without its arguments.
• Environment: the CLI version and install method, the operating system, the CPU architecture, and the Python version.

Before the CLI sends a report, it removes API keys, entitlement tokens, passwords, email addresses, IP addresses, file paths, your user and machine names, and host names that are not Cloudsmith hosts. The CLI never sends environment variables, local variables, or source code. The error message can include workspace, repository, and package names.

Error reporting is on by default, including in CI. A failed command waits at most 2 seconds for its report to send.

Turn off error reporting

If you prefer not to send error reports, use any of the following:

• Environment variable: set CLOUDSMITH_NO_TELEMETRY=1, or the cross-tool DO_NOT_TRACK=1.
• Config file: set telemetry = false under [default] (or a profile) in config.ini.

In a CI pipeline, set the variable for the whole job:

env:
  CLOUDSMITH_NO_TELEMETRY: "1"

For more details, see CLI telemetry in the Cloudsmith documentation.

Connect through TLS-intercepting proxies

v1.30.0 adds --without-ssl-verify-strict for networks that inspect encrypted traffic with a TLS-intercepting proxy. Python 3.13 and later apply strict X.509 certificate checks by default, and the standalone binaries ship with the Python 3.14 runtime. Many intercepting proxies issue certificates that fail these checks, for example with Basic Constraints of CA cert not marked critical, so the CLI could not connect.

The new option turns off only the strict checks. The CLI still verifies the certificate chain and the host name, unlike -S, which turns verification off completely.

cloudsmith check service --without-ssl-verify-strict

You can also set it once:

• Environment variable: set CLOUDSMITH_SSL_VERIFY_STRICT=0.
• Config file: set ssl_verify_strict = false under [default] in config.ini.

The setting applies to API calls, single sign-on (SSO), uploads, downloads, the Model Context Protocol (MCP) server, and cloudsmith update.

When a certificate check fails, the CLI now stops at once instead of retrying, and the error includes a hint with the cause. For a failed strict check, the hint names --without-ssl-verify-strict. For a certificate from a certificate authority (CA) that the CLI does not trust, the hint names REQUESTS_CA_BUNDLE, which points the CLI at a CA bundle that contains your proxy's CA.

v1.30.0 also adds general names for the setting that turns certificate verification off, because it covers more than API calls: pass --without-ssl-verify, set CLOUDSMITH_SSL_VERIFY=0, or set ssl_verify = false in config.ini. Existing scripts and config files keep working: -S, --without-api-ssl-verify, CLOUDSMITH_WITHOUT_API_SSL_VERIFY, and api_ssl_verify are still accepted.

For more details, see Troubleshooting in the Cloudsmith documentation.

Credential helpers install to ~/.cloudsmith/bin

cloudsmith credential-helper install now puts the Docker, Cargo, and pnpm helpers in ~/.cloudsmith/bin by default, instead of the directory that contains the cloudsmith executable. When the CLI is installed with a package manager such as Homebrew, that directory belongs to the package manager, so an upgrade could remove the helpers.

If ~/.cloudsmith/bin is not on your PATH, the Docker and Cargo install commands print the line to add to your shell profile. On Linux and macOS, add this line:

export PATH="$PATH:$HOME/.cloudsmith/bin"

• Choose another directory: pass --bin-dir.
• Terraform: the Terraform helper keeps using Terraform's plugin directory.
• Helpers from earlier versions: they stay where they were installed. To remove one with cloudsmith credential-helper uninstall, pass its directory with --bin-dir.

For more details, see Automatically discover Docker credentials in the Cloudsmith documentation.

Domains come from your API host

cloudsmith domains list and the credential helpers now get your workspace's domains, including custom domains, from the Cloudsmith API host that the CLI is configured to use, instead of a list built into the CLI. They now work with Cloudsmith deployments other than the default one.

• domains list output: the JSON document keeps its version 1 shape. primary and created_at are now always null, because the API does not return them, and domain_type can also be cloudsmith_api.

For more details, see Custom domains in the Cloudsmith documentation.

Send all CLI requests through one proxy

v1.30.0 adds --proxy, which sends every HTTP request the CLI makes through one proxy. This includes API calls, uploads, downloads, the MCP server, cloudsmith update and the background update check, the credential helpers, OpenID Connect (OIDC) detection on Amazon Web Services (AWS) and Google Cloud, and error reports. --api-proxy covered only some of these connections.

You can also set CLOUDSMITH_PROXY, or set proxy in config.ini. Existing scripts and config files keep working: --api-proxy, CLOUDSMITH_API_PROXY, and api_proxy are still accepted. cloudsmith credential-helper install terraform also saves the proxy in ~/.terraformrc, so the helper uses it when Terraform runs it.

A configured proxy now takes precedence over the HTTPS_PROXY and HTTP_PROXY environment variables. Without one, the CLI uses HTTPS_PROXY, HTTP_PROXY, and NO_PROXY as before.

Username and password login is deprecated

cloudsmith login and cloudsmith token are deprecated, and will stop working on November 20, 2026, when Cloudsmith disables username and password login. If you authenticate the CLI by running cloudsmith login or cloudsmith token with a username and password — including from scripts and CI jobs — you need to switch to an API key before that date.

Until then, both commands work as before and print a deprecation warning to stderr. For more details, see the deprecation changelog.

Requirement changes

• The Python package now requires requests 2.32.5 or later.

Other improvements

• cloudsmith credential-helper install terraform now saves your workspace and API host in ~/.terraformrc, so the helper finds the right domains when Terraform runs it, while existing entries that use --org keep working.
• cloudsmith download now exits with code 1 when a file fails to download, so scripts and CI jobs can detect the failure.
• cloudsmith tokens create now reports API errors and exits with a non-zero code, and --save-config no longer fails with JSON output or when you choose not to replace an existing token.
• cloudsmith credential-helper install cargo now registers the credential provider on the first run when ~/.cargo/config.toml exists but has no [registry] table.

For a more detailed list of changes, see the changelog on GitHub.