Cloudsmith glossary
29 glossary definitions
A
Artifact provenanceArtifact provenance is verifiable information about where a software artifact came from and how it was built. It works like a chain of custody,…Audit trailAn Audit Trail is a chronological, tamper-resistant record of actions taken within a system, such as user logins, configuration changes, approvals, or data access…
C
Code signingCode Signing is the process of digitally signing software so users can verify two key facts:ComplianceCompliance refers to following the laws, regulations, standards, and internal policies that apply to an organization. These rules may relate to data protection, financial…Cooldown policyA cooldown policy is a rule that holds newly published packages for a set period before they can be installed. It gives the community…CopyleftCopyleft is a licensing principle used in some open-source software that allows users to freely use, modify, and distribute code, as long as any…CVE (Common Vulnerabilities and Exposures)A CVE is a standard identifier assigned to a publicly disclosed security vulnerability in software or hardware. Each identifier follows the pattern CVE, year,…
D
Data privacyData Privacy refers to the responsible handling of personal and sensitive information, including how it is collected, stored, used, shared, protected, and eventually deleted.…Dependency confusionDependency confusion is an attack where a build installs a malicious public package instead of an internal package with the same name. It works…Dependency firewallA dependency firewall is a control layer that decides which external packages may enter your environment before anyone can use them. It works like…
G
General public licenseThe General Public License (GPL) is one of the most widely known copyleft open-source licenses. Created by the Free Software Foundation, its purpose is…GPG keyA GPG Key (GNU Privacy Guard Key) is a cryptographic key pair used for encryption and digital signatures. It allows users and systems to…
L
License complianceLicense Compliance is the practice of ensuring that all software within an organization is used in accordance with its licensing terms, whether the software…License managementLicense Management is the process of tracking, controlling, and optimizing software licenses across an organization. It ensures businesses remain compliant with license agreements while…
M
O
P
Package signingPackage Signing is the process of cryptographically signing software packages – such as libraries, installers, updates, or container images, so users can verify their…Policy as codePolicy as code is the practice of writing security and compliance rules as versioned, machine-enforceable code. Instead of a document that people must remember,…
S
SBOM (Software Bill of Materials)A Software Bill of Materials (SBOM) is a detailed inventory of every software component that comprises an application, including open-source libraries, third-party dependencies, frameworks,…Security scanningSecurity Scanning is the process of automatically examining software, systems, code, and infrastructure to detect security vulnerabilities, misconfigurations, malware, and risky behavior before attackers…SIEM (Security Information and Event Management)Security Information and Event Management, or SIEM, helps solve cybersecurity problems by aggregating and analyzing log data from across an organization’s entire digital…Software license complianceSoftware License Compliance is the practice of ensuring that all software inside an organization from SaaS subscriptions to open-source libraries, is being used strictly…Software supply chain attackA software supply chain attack is a cyberattack that targets an organization by compromising the third-party components, tools, or processes used to build and…Software supply chain securitySoftware Supply Chain Security is the practice of protecting every stage of the software lifecycle, from coding and dependency selection, through building, signing, distribution,…
T
Transitive dependencyA transitive dependency is a package your software needs indirectly because one of its direct dependencies requires it. If you add package A and…Trusted publishersTrusted Publishers are verified organizations or developers who digitally sign and distribute software so users and systems can confirm the authenticity of the source.…TyposquattingTyposquatting is publishing a malicious package with a name almost identical to a popular one, to catch mistyped or misremembered installs. A single swapped…