Following our announcement last week about our 

, we have released two new feature enhancements.

Modules fetched from proxy.golang.org can now be cached in your Cloudsmith repository.

This allows all your Go modules to be stored and consumed directly from Cloudsmith, enabling vulnerability scanning, license compliance checks, and the ability to apply policies to your Go Modules.

Cloudsmith can now proxy requests to the 

), allowing verification of public Go modules. The global checksum database is a public transparency log containing a list of checksums for every module stored in the Go Module Proxy. This verification method allows you to detect any tampering attempt on your libraries.

Cloudsmith now gives you stronger control over your software supply chain by blocking downloads of any package that doesn’t pass your organization's security and compliance policies, including packages fetched from upstream registries.

Until now, Cloudsmith applied policy enforcement after the first download of a package proxied from an upstream registry. The package would be served immediately, and if the upstream source was configured to proxy and cache, the package would then be scanned and checked for policy violations. This behavior was intentional. It let customers prioritize speed for their developers 

while building workflows that protected production environments from vulnerabilities

. Subsequent requests for the package would be subject to policy checks. 

As awareness of software supply chain risks has grown, customers are now looking to extend the same level of protection to every touchpoint, including developer machines, starting from the very first download.

Now, you can configure Cloudsmith to delay that first download entirely, preventing developers and build tools from downloading a vulnerable or non-compliant package. 

This new enhancement to policy management acts as an important checkpoint option for all proxied package downloads. Here’s how it works:

: Any download request for a package that is not yet in your Cloudsmith repository and needs to be fetched from an upstream source, will be delayed until the package has been scanned, synchronized, and evaluated against your organization and repository policies.

: This feature ensures that only packages that have successfully passed all policy checks can be downloaded by developers or build pipelines, significantly enhancing the integrity and security of the packages served.

We are launching this new option in early access to all current Ultra plan customers to gather valuable feedback from our users and ensure it meets their needs. Your input will be crucial in refining and perfecting this and future enhancements to our policy management features.

 in order to start using this new feature and take your policy management to the next level.

Enforce policies before any package download, even from proxied upstream registries 

You can now integrate Cloudsmith into Datadog using our 

. It’s got the the Cloudsmith integration installed and ready to use, removing manual steps from setting up the 

Previously, you had to manually install the Cloudsmith integration into your own Datadog Agent containers or hosts. This added complexity to observability pipelines and risked version drift. Our new Docker image solves that: it packages the official Datadog Agent with the datadog-cloudsmith integration pre-installed and pinned to a known-good version. The image is automatically rebuilt and 

 whenever a new Cloudsmith integration version is released.

Built from the official Datadog Agent base image (

Installs the Cloudsmith integration at build time using 

 at runtime to configure Cloudsmith monitoring

 makes it easy to visualize your artifact usage, package delivery, audit logs, and the security and compliance status of your artifacts. It also helps you monitor Cloudsmith consumption and usage trends, along with detailed audit and security data to help you detect any unusual activity.

 if you have any feedback or questions. We’re here to help.

Connect Cloudsmith to Datadog more easily with our Containerized Agent

 to refine the scope of your repository's retention rules when configuring them via the 

This flexible query language lets you filter packages by tag, version, downloads, and more, making it easier to target exactly which packages to keep or remove.

 field when setting up your repository’s retention rules, you can apply policies to a specific subset of packages within the repository, such as:

You can include multiple search filters, which work alongside existing configuration options like age limits, to enable smarter and more tailored retention policies. For example:

Delete packages that are older than 30 days AND have no tags AND have never been downloaded.

Here is a sample query that deletes packages older than 180 days that 

We’re actively working on adding support for search-based retention rules to both the Cloudsmith web UI and the Terraform Provider, so you’ll be able to configure them wherever you work.

 for more information on configuring package retention rules for your Cloudsmith repositories.

Keep only what matters using search-based retention rules

We’ve added support to proxy Go modules from 

 through Cloudsmith. This gives developers a simpler, more reliable way to manage Go dependencies by using Cloudsmith as a single source for public and private modules.

: Easily set up your Cloudsmith repository to proxy Go modules from 

: Developers can point to a single source - Cloudsmith - for both public and private modules.

: We plan to add support for caching Go modules in Cloudsmith repositories. This will allow even greater control, with support for vulnerability scanning, license compliance and usage insights.

Update your GOPROXY from the legacy Go endpoint (

). Once you’ve switched endpoints, simply configure your Go upstream in Cloudsmith and start making requests. Your repository will proxy modules automatically from 

Go upstreams support is currently in Early Access.

 if you wish to enable this feature and check out 

Go upstreams: Proxy Go modules with Cloudsmith 🚀

, making installing the Cloudsmith CLI straightforward and quick. For developers already using 

, simply add the tap and install the CLI. Since Homebrew manages dependencies, you don’t need to install or manage Python yourself. Homebrew takes care of it for you.

Now you are ready to use Cloudsmith’s CLI as part of your workflows.

Our Homebrew tap is open source, and we welcome contributions. Also, we are currently hosting the tap as we don’t (yet) reach the threshold to be added to the official repo. A new star or watcher will help us get there, though, so don’t be shy. We want to make it as easy as possible to use Cloudsmith in your toolchain.

If you have feedback or questions, please 

A simpler way to install the Cloudsmith CLI with Homebrew

You can now publish and manage Helm charts in Cloudsmith using modern OCI-based workflows. Charts pushed via Helm V3 to our OCI-compatible registry are correctly identified in the UI and supported through a new dedicated endpoint: 

. These improvements build on our full support for OCI v1.1 compliance and make adopting Helm’s latest distribution model easier.

Previously, Cloudsmith offered a Docker registry at docker.cloudsmith.io that was fully compliant with the OCI v1.1 standard. While users could push any OCI artifact to this registry, non-Docker artifacts were still displayed as Docker packages, making it harder to work with and manage your artifacts. 

Now, both OCI-compliant and traditional (non-OCI) Helm charts are supported and clearly labeled in the UI, providing better visibility and smoother workflows.

Here’s how to push a chart using Helm’s OCI support:

While Cloudsmith OCI Registries are GA, our Helm OCI registry is in Early Access, so some Cloudsmith features like Helm OCI Upstreams aren't yet available. Please, contact 

Go module caching and checksum verification

Caching for Go modules

Proxy to Go Checksum Database

Other logs

Enforce policies before any package download, even from proxied upstream registries

Connect Cloudsmith to Datadog more easily with our Containerized Agent

Keep only what matters using search-based retention rules

Go upstreams: Proxy Go modules with Cloudsmith 🚀

A simpler way to install the Cloudsmith CLI with Homebrew

Improved support for Helm Charts with native OCI integration