Getting Started with Maven and Cloudsmith

A short demo of how to get started with Maven packages and Cloudsmith, including deploying a Maven package to Cloudsmith and then downloading it as a dependency.

https://help.cloudsmith.io/docs/cran-repository

The following is a true story. It doesn’t have a happy ending.

Horrors lurk beneath the trap door, for there is always something down there, in the dark, waiting to come out...

The Thing Upstairs glares across the conference table, already knowing the horrible truth, “What license does it have?”

Berk confidently replies, “GPL version 3.”

Berk is an experienced software developer at a well-known consultancy firm, TrapDoor Inc. He’s worked his way up the ranks, paid his dues, and has been given his first solo project.

A customer has asked TrapDoor Inc. to architect and build a software tool. The problem specification is well-defined, but the solution design, architecture, and implementation details can all be decided by Berk.

The high-level design gets approved, and Berk gets to work. The agreement with the customer is to release often and early as they too are a software consultancy and can run tests internally and externally on their customers’ sites.

After about five weeks of development, the first alpha is released.

A week after that, the third iteration is released to much fanfare. Good, steady progress is being made.

Only then does The Thing Upstairs stir and decide to code review Berk’s solution. The findings are shocking. Berk’s solution relies heavily on an open-source project with a copyleft GPL v3.0 license.

Copyleft is the practice of granting the right to freely distribute and modify intellectual property with the requirement that the same rights be preserved in derivative works created from that property.

Berk has spent seven weeks writing logic that is attached to the original license, not fit for commercial handover, and now likely being run illegally on customer sites, without the proper license or attribution.

Worst of all, the original source code for the dependency was copied into a TrapDoor Inc. repository and modified with Berk having explicitly deleted the license file.

Little could be done without a page-one, clean-room rewrite, using a dependency with a more permissive license. But we’ll never know. This story doesn’t have a happy ending. Trust was lost. The six-figure project was canceled. The customer refused to pay.

All because Berk didn’t think licensing was important.

DevOps Horror Stories: Software License to Kill

In keeping with our vision of offering a universal feature set across all the package formats we support, we are delighted to announce that we are now offering configurable upstream proxying and caching support for 

As we touched upon when announcing the same for Debian and 

 packages, there are a lot of reasons why this is a really 

, so instead of going over those again, let’s jump straight into how you can set this up in you Cloudsmith repository.

We don’t think that we could have made this much easier to configure (but, of course, we would love to hear 

In your Cloudsmith repository, you’ll see a menu item called “Upstream Proxying”. This is where we will configure our upstreams. Simply click the “Create Upstreams” button and select “RedHat” to create a new RedHat upstream:

You will then see the “Create RedHat Upstream” form:

You just need to add a Name for the upstream, the upstream URL, and a priority weighting – If you have multiple upstreams this will determine the order in which they are used.

We can choose to fetch and cache any requested package (instead of just fetching them), and to verify the SSL certificates provided by the upstream. Then, we select the individual distribution for this upstream.

Optionally - we can also add a GPG key, if required, for package signing, authentication headers for private repositories that require authentication and also some arbitrary headers if you wish to send something custom along with your request.

And that’s it, we have now added a new Redhat upstream to our Cloudsmith repository.

So now, the next request for a package that isn’t present in this repository will be passed through to the upstream and the package fetched it if it is available there. If you also enabled “fetch and cache”, the package will be cached in your Cloudsmith repo for any future requests.

By adding Redhat upstream proxying and caching, we are moving forwards towards our goal of being the most universal package management solution for your development, deployment and distribution workflows. We would love you to join us on this journey, and we are very excited about the platform we have built, the service that we provide, and where we are going to next. Sign up for free today, and experience Cloudsmith for yourself!

Caching and Upstream Proxying for RedHat Packages

Teams and Access Controls

A short video to show how to set up teams and configure access permissions in an organization on Cloudsmith.

Emojis are finally useful for more than sentiment or sass. Cloudsmith Engineering can now be raised in emergency situations via a single emoji - SOS.

And it’s been used for the first, and so far only, time.

At Cloudsmith, we pride ourselves on our reactive (and in many cases proactive) support. We architected and built the platform with monitoring in mind allowing us to provide transparency of internal operations to you and us. We utilize numerous tools to help us provide the best package logistics experience to our customers. All our customers, all the time. Statuspage, Datadog, Intercom, Slack are all critical components to the Cloudsmith Experience just as Cloudsmith is a critical component in your software lifecycle.

Up until a few months ago, we ran support on a fairly ad-hoc basis. We have a passionate team in Engineering willing to stay up late and get up early for the exigencies of the service.

However, it was time to formalize the support function. We evaluated a number of products but ended up going with Opsgenie (sidenote; some of the competitors missed out on a sale because of non-responsive support… all we wanted was a trial extension). We implemented a sane rota with primary and secondary levels and put it into force.

This had the nice side-effect that productivity in Engineering went up. Now, the team not on rota could relax from the burden of support and focus on building product. And those active on the rota could relax, talk to customers and fix bugs, or achieve small tasks in-between times. It was a win-win for everyone.

But we wanted more.

Now, we had the power and ability to raise and contact Engineering in off hours if we needed to. What if a customer, in distress, could do the same?

We added emoji support for all Ultra level customers via Slack. Our customers can now directly raise a Cloudsmith engineer if they feel the service is underpowered or having critical issues.

To date, our service uptime is 99.99% and the last two incidents were only degraded service, highlighted early by our monitoring and immediately managed by the team feverishly rerouting traffic across regions to prevent the vast majority of our customers and our customer’s customers from noticing anything was sub par.

Only once has the SOS emoji been used in anger. A 

 behavioral issue that was blocking pipeline builds. Our dutiful customer raised the alarm, we rolled back a change from the previous day, resolving the issue from bed to deployment within about 30 minutes.

We thanked them.

They still have three challenges remaining.

Support via Emoji

Getting started with R Packages and Cloudsmith

A short walkthrough of getting started with R packages and Cloudsmith, including uploading an R package and then installing it.

Getting Started with R Packages and Cloudsmith

Custom EULA

It is simple to add a custom End User Licence Agreement for your package downloads in a Cloudsmith repository.