Every business, from startups to established enterprises, feels the urgency to scale their software delivery. Why? Because scaling ensures that as a business grows, its software delivery mechanisms can handle increased demands without compromising on quality or speed. A fast delivery cycle is especially crucial for businesses that experience spikes in traffic, and they must respond to user needs promptly, ensuring timely assistance and resolution.

However, scaling isn't just about handling increased demand. It's about agility, security, and efficiency. Businesses that can't scale effectively risk security breaches, delayed product launches, and operational inefficiencies.

Let’s take a look at some of the challenges behind scaling software delivery, best practices when it comes to scaling, and see how Cloudsmith stands out as first-in-class as an industry leader.

Continuous Delivery (CD) is a culmination of years of refining software development practices. It's not just a methodology; it's a culture. From the days of the Waterfall model, where software development was linear and often rigid, to the Agile era, where flexibility and adaptability became the focus, we've come a long way. CD takes it a step further. It's about ensuring that software is always in a deployable state.

This adaptability means businesses can swiftly respond to market changes, customer feedback, or any unforeseen challenges. The essence of CD is to reduce the gap between development and deployment, ensuring a seamless flow of software updates to the end-users.

Scaling software delivery is like preparing a business for growth spurts. It's about foresight and readiness. When software delivery is scaled effectively:

: Businesses can roll out features or fixes in response to market trends or demands swiftly. This agility can be a competitive advantage, allowing companies to stay ahead of the curve.

: With frequent updates and improvements, customers feel heard and valued. It leads to better user experiences and can significantly boost brand loyalty.

: A faster time-to-market means businesses can tap into new revenue streams quicker than competitors. Whether it's a new feature that users are willing to pay for or an entirely new product line, scaling ensures that businesses are always ready to monetize their innovations.

Challenges in Delivering Software at Scale

Of course nothing in life comes without its hurdles, and scaling software delivery isn’t any different. The following are some common issues that companies face everywhere:

 An inefficient system can push developers to the brink. Imagine a critical bug discovered just before a major release. The pressure to troubleshoot and rectify before the deadline can be immense, leading to overworked and stressed developers.

: In the rush to deliver, teams might opt for quick fixes. These "band-aid" solutions might address the immediate issue but can accumulate as technical debt, leading to bigger problems down the line.

: Speed should never come at the cost of quality. Yet, some teams, in their bid to release rapidly, might overlook crucial quality checks, leading to sub-par software releases.

: Every software release carries a degree of unpredictability. Without a robust system in place, these releases can lead to increased production costs, missed deadlines, and more.

 Errors in the production environment can have dire consequences. From minor glitches to major system crashes, production failures can erode user trust and impact the bottom line.

: Manual monitoring in a high-velocity release environment can lead to increased turnaround times for error resolution.

: Inefficient scaling can slow down product launches, depriving businesses of potential revenue and competitive advantage.


Leveraging Cloudsmith for DevOps Excellence

In the quest to scale software delivery, the tools and platforms you choose play a pivotal role. Cloudsmith emerges as a comprehensive solution, addressing multiple facets of the DevOps journey.

At the heart of any successful DevOps initiative is a culture that allows for collaboration and knowledge sharing. Cloudsmith enhances the developer experience throughout the software development lifecycle. When developers are deeply invested in their work, the entire software delivery process benefits.

Prioritizing security in Continuous Delivery cannot be an afterthought, and it certainly isn’t for Cloudsmith. The platform’s universal, cloud-native solution ensures robust software artifact management and supply chain security. From automated security configurations to tools that detect vulnerabilities, Cloudsmith ensures that security remains front and center.

Simplifying your tech stack is one of the most beneficial things you can do for your organization and team as a whole. Cloudsmith offers a multifunctional platform that streamlines the technology stack, allowing businesses to focus on one comprehensive solution that meets multiple needs, without compromising on quality, security, or control.

Scaling software delivery is a journey, one filled with challenges but also immense opportunities. With Cloudsmith as your partner, businesses can navigate this journey with confidence, ensuring that their software delivery processes are agile, secure, and efficient. After all, building products doesn’t really have an ‘end’— we are constantly learning, evolving, and expanding our knowledge of how to build great products. But with precision and purpose, we can build products that truly matter.

Scaling Software Delivery: Continuous Delivery, Overcoming Challenges, and the Power of Cloudsmith

Efficiency and organization are key when it comes to 

. As teams work to deliver high-quality software at an increasingly fast pace, the need for effective management of the various components of the software development lifecycle has become paramount. One aspect of this lifecycle that often gets overlooked, but is crucial to the smooth functioning of the development process, is artifact management.

Let’s explore artifact management, what it means for you as a developer, why it's an essential part of your toolkit, and the numerous benefits it can bring to your software development process.

Artifact management refers to the process of storing, versioning, and tracking binary files, or "artifacts," that are produced during the software development process. These artifacts can include compiled source code, libraries, and documentation, including operating packages, NPM and Maven packages (or container images like Docker.) The goal of artifact management is to ensure that these files are stored in a secure, organized, and accessible manner, enabling developers to retrieve and deploy them as needed.

Artifact management is about creating a systematic approach to handle the various outputs of your software development lifecycle. It's like a library for your software components, where each artifact is a book that needs to be properly cataloged, stored, and made available for future reference.


The Importance of Artifact Management in DevOps

Devops entail a set of practices that aims to shorten the system development life cycle and provide continuous delivery with high software quality. In this context, artifact management plays a vital role in maintaining the speed, efficiency, and reliability of the software development and deployment process.

In a DevOps environment, the rapid, continuous development and deployment of software can generate a large number of artifacts. Without a proper management system, these artifacts can become disorganized and difficult to track, slowing down the development process and increasing the risk of errors or security breaches.

Artifact management tools help to address these challenges by providing a centralized repository for storing and tracking artifacts. This not only helps to keep the artifacts organized, but also makes it easier for developers to find and deploy the correct versions of the artifacts they need.

These types of tools can provide additional features such as 

, which can further enhance the efficiency and reliability of the software development process.


10 Benefits of using an artifact management platform


Artifact management systems provide robust controls for managing the flow of artifacts, including features for promoting, rolling back, and deploying packages. This gives you the ability to manage your software components in a structured and organized manner, ensuring that only the correct versions are deployed.

These systems offer a comprehensive view of your artifacts, including their names, versions, types, and metadata, helping you to keep track of your assets. This visibility is crucial for maintaining an overview of your software components and understanding their interdependencies.

Artifact repository tools can support multiple packaging technologies and provide APIs for easy manipulation, enhancing interoperability and flexibility. This means that regardless of the technology stack you're using, you can manage all your artifacts in a single, unified system. (Think of this like normalising the experience across multiple artifacts types/formats, kind of like bringing order to chaos!)

These systems are designed to be secure by default, providing features such as encryption in transit and at rest, digital signing, and permission management. This helps to protect your software components from unauthorized access and tampering, ensuring the integrity of your software.

Artifact management systems provide metadata for tracking the history and dependencies of your artifacts, enhancing accountability and reproducibility. This traceability is crucial for understanding the evolution of your software components and for troubleshooting issues that may arise.

These systems provide access logs and metrics for tracking the usage of your artifacts, helping you to monitor and optimize your operations. This auditing capability is crucial for maintaining accountability and for understanding how your software components are being used.

Artifact management systems offer fast, global distribution of your artifacts, helping to speed up the development and deployment process. This can significantly reduce the time it takes to get your software to market, giving you a competitive advantage.

These systems can provide a layer of redundancy for public services, ensuring that you can access your artifacts even if the public service is down. This availability is crucial for maintaining the continuity of your operations and for ensuring that you can deliver your software on time.

Artifact management systems support collaboration by allowing you to synchronize workflows and processes within distributed teams. This can enhance the efficiency of your operations and foster a culture of shared responsibility and teamwork.

Using an artifact management system can be more cost-effective than building and maintaining your own system, freeing up resources for you to focus on your core product. This can help you reduce costs, increase productivity, and deliver better software.

Artifact management is a crucial component of the DevOps toolkit that can provide numerous benefits in terms of control, visibility, and security. Whether you're a small team or a large organization, implementing an artifact management system can help you to streamline your operations and enhance the quality of your software. By investing in artifact management, you can ensure that your software development process is as efficient, reliable, and effective as possible.


If you want to start automating today, Cloudsmith offers a fully-featured 14-day trial to sign up.

10 Awesome Benefits of Artifact Management and Why You Need It

What were the trends for DevOps tools and culture in 2022? I talked to Aisling Conroy, Senior Manager of Competitive Intelligence at CircleCI and Luke Kilpatrick Director of Developer Experience at LinearB, to review the year and discuss key learnings and trends at our December webinar.

In 2022 did we get any better at developing software?
- Did we make any headway at automating human frailty out of building software?
- Did AI make a difference in building software?
- Does the focus on multi-cloud mean the death of on-prem?
- How healthy is open source after the big shock of Log4Shell?

2022 started with a huge amount of ambition from tech companies which did so well during the pandemic. As the year went on, the belt tightened, and so did plans; as Aisling put it, "everyone has a plan until you get punched in the face." She notes although the grand plans may not have been executed, we got a lot done, but there is still much more to do.

Some of the 2022 trends Luke and Aisling identified included:

Platform Engineering dedicated to improving workflow

AI tools to augment the software developer

I'm going to sum up 2022 DevOps as "the year of the workflow", where we have dedicated people and tools focused on fixing and improving workflows.

Both Linear B and CircleCI are trying to speed up developer workflow.

Aisling tells us that at CircleCI, they want an optimal-size pipeline run of around 10 mins. She sees pipelines on the CircleCI platform become more advanced as customers build more advanced applications than ever, but in some cases, software delivery cycle times have stagnated. "Teams have gone from once a quarter to once a month, which is great, but ideally, we want teams to be able to move at the speed of their creativity."

To improve speed, Aisling tells us there is a focus on tooling, better integrations, interoperability, and spending less time on the manual stuff to become more efficient.

Luke notes that LinearB's customers tend to do a great job of optimizing the ops pipeline but if there is a problem, there are still humans involved. At LinearB, they have done a lot of research on the developer team workflow. They have looked at 10's of thousands of code reviews (PR's) and other areas where there were bottlenecks and found a massive bottleneck around code reviews. So they took this information and tried to help fix the problem. This is what lead to gitStream. Like most things in computing, humans are usually the slowest part of the system. If you have an amazing CI/CD system using CircleCI or other tools, your deployment and delivery problems get reduced. There has been a ton of amazing work done here in the past 10 years. However, checking quality and making sure good code is getting merged is still hard to do. The gold standard is still a peer review of the code.

The biggest slowdown is a lot of small changes don't need this review and a lot of the big ones need to get reviewed more. So LinearB made a tool to help, and best of all, it's free!

Dedicated Experts in Workflows- Platform Engineering

Luke notes that the previous years in DevOps have been focused on the ops side, and a lot still is, but we saw a lot of great stuff coming out to help the developer side of the house. There is also a shift to Developer Experience improvement, also called platform engineering. This really became a big thing in 2022.

Luke likened a platform engineer to a sous chef working alongside a high-end chef. Most high-end chefs are only as good as their sous chef.

Having dedicated experts at a senior level reviewing and improving pipelines and workflow is a big trend for 2022.

The panel agreed there was a big focus on identifying and improving flaky tests. CI tools are highlighting and running metrics on your testing suite. Rerunning flaky tests or turning them off is not good enough. Companies are expected to do more with less, and robust test suites are an avenue for this.

AI tooling for software development is having a moment- from GitHub's CoPilot, CircleCI acquisition of Ponicode to the recent surprise of ChatGPT, which forced StackOverflow to ban answers from the AI tool.

At the start of the year, Aisling was quite bullish on AI, and she saw it being used to help developers.

She notes that this is an example where we all got very excited at the start of 2022, and we all thought we'd be living in a different world by the end of the year. We've seen many companies make efforts in the AI area over the past year, and it's been good progress, but actual progress has not come close to where we anticipated it to be.

But as we see AI tooling moving to where we write code, like CoPilot and Ponicode, it is bound to change how we develop software in the coming years.

Boring Programming Languages are making waves

I love comparing languages- the loyalty people feel towards their chosen programming language and the ecosystems it creates are the closest software comes to football.

y on the best and worst programming Languages for developer workflow. LinearB's metric dashboard has used its data on thousands of dev teams and hundreds of thousands of pull requests to see how languages compare with respect to PR lifespans.

It turns out, that Java and C# have a significantly shorter PR lifespan compared to other languages.

Luke tells us that Java and C# are more mature languages that have great tooling integrated into their workflows.

This year the discussion around hybrid cloud has shifted to multicloud. I wondered if this meant that on-prem is just yesterday's news - case closed?

Both Luke and Aisling disagreed!

Aisling says that there is always going to be some users that will need on-prem, maybe in niche industries like mining, aerospace etc. The trend has been steady in 2022 and will continue in 2023. MultiCloud will continue to gain more traction. In fact, Google had this as a prediction in their GoogleNext conference in September. There is talk of US legislation specifying that large corporations must follow a multi-cloud strategy. But there are still certain types of computing that customers might want to have in-house. Apple M1 is an example of this, though I think we'll see a lot of progress in the coming year in cloud companies being able to provide a growing variety of configurable compute options.

Luke, as a former Nutanix guy, believes on-prem will always have its place, but cloud tech will be part of it and moving loads from on-prem to public will become easier and faster. The tools for doing this are getting better. At the moment for large organizations, on-prem tends to be cheaper in the long run. Luke sees companies using a burst model where you can use infrastructure out to the cloud for big bursts of traffic.

MultiCloud strategy is definitely a 2022 trend, but it hasn't killed off on-prem just yet.

2022 started with teams scrambling to find out if they were affected by the 

 vulnerability found in a commonly used open source package called Log4J. It has become clear to most teams this year how dependent they are on open source software and that to truly secure software supply chains, a coordinated effort is needed from the whole software community.

For me, 2022 was the year where tooling began to help teams see what open source software is being used in their products and to help secure software supply chains. Open source tools like Sigstore, Grype, Trivy and Syft have made big waves this year.

Security by obscurity is thought less of:

GitStream is currently being giving it away from free

If you Open Source something, you better reach a certain standard

Aisling saw a trend in open source to improve interoperability in open source tools with Open Policy Agent tools. She was also impressed with how many open source software delivery tools matured, including Argon and Flux. Both Luke and Aisling see open source in a much healthier place at the end of 2022.

Concentration on workflows from a tooling and human level, appreciation of open source and glimmers of what AI can do to improve software development.

Join us on January 31st for our next webinar, which will continue the State of DevOps discussion - A Look Ahead at 2023. Registration information is coming soon.

Recap: 2022 State of DevOps Webinar

plans (OSS not affected by changes); however, significant features have been moved down (or added). We did it to build a better Cloudsmith. You may find a better fit at a lower or higher tier, so view your organization's

Buckle up. This is a long post but a necessary one!

You’ve probably heard that we changed the pricing plans late last week. And we wanted to dig into the why behind the changes, give you our reasoning for doing so, and let you know why it represents incredible value across all plans. So let’s talk about it...

This pricing change is the first that we’ve made since 

, before the global pandemic, and only the second in the company's history; would you believe we have been talking about the shape and structure of our pricing 

Over the last three years, we have watched our community grow; we constantly listened to you, our illustrious customers, and our swathe of advisors, stakeholders, and partners. All of whom held strong opinions on how we should charge and what should be charged.

We don’t make changes without deep thought and consultation, and the decisions for things like this are never easy. The bottom-line driver for the change is building, delivering, and supporting more value than ever before. It’s a reinvestment for growth.

So, let’s revisit why we’re doing this in more detail, and then we can arrive at what it means for everyone, both for us and you. Ultimately, though, it’s to 

To enable security at the core of the software supply chain

We are a part of your software supply chain and, in some cases, the driving factor, so as a vital link in worldwide distribution from source to the point of delivery, security is at the core of our concerns (as it should be, yours!) Building a high-quality and secure product isn’t easy or cheap, but it’s an essential part of our investment in the ecosystem.

In addition to implementing deep security at Cloudsmith and ensuring that we meet standards such as ISO27001 and SOC2, we also want to ensure that any customer using Cloudsmith can quickly and simply implement secure artifact management best practices and processes, something that we coined as 

To evolve Cloudsmith into something even better than before

We want to build the world’s best Artifact Management solution in the Cloud 

. A lot has changed around artifact management since 2019 - improved solutions for automation, wider adoption of DevOps, more focus on security, and a dramatic rise in software supply chain attacks. The post-pandemic world is also a very different economy, and together with the evolution of the ecosystem, companies worldwide (including Cloudsmith) need to adapt.

We believe Cloudsmith is well-positioned to help organizations adapt to the changing landscape by enabling them to solve problems of scale and complexity through cloud-based artifact management. We provide end-to-end visibility and control of software assets, data, and dependencies, from source to delivery.

We believe strongly in listening to our customers as we build a product that solves their needs. In addition to driving our product roadmap, your feedback also contributed to the new plans we’ve rolled out. We want to ensure customers can find a plan that meets their needs now and as their organizations grow and require more complex compliance and security.

Our services will continue to evolve to ensure we can meet the needs of our customers in the future, and we will solve problems of trust at scale with a single global source of truth for all software, underpinned by the best-in-class Artifact Management in the Cloud; exactly as designed based on your feedback wants and needs.

Like security, scaling isn’t easy, and we need to balance supporting customers and building more value into the service. The pricing increase will enable us to re-invest more back into the product while still maintaining our capability to help you as you grow with Cloudsmith. In short, more and better value across your organization faster than before.

Pricing has increased across all paid plans; however, significant features have been moved down (or added) to enable secure artifact management across all plans. To best understand the impact on your organization, please view

 in the application to see the vital differences. The changes make it easier and cheaper for you to lean into Cloudsmith and reap the benefits of global distribution at scale, with more control and visibility built-in.

Providing universally secure Artifact Management at the core

We care deeply about security. We see Cloudsmith becoming a vital part of our customer's security toolkit every day. We want to enable any team using Cloudsmith to implement best practices in terms of security. We’ve moved Single Sign-On via SAML, Audit Logs, Sigstore Cosign, and Service Accounts from Ultra-only features down to Team (and beyond). We’ve also introduced the ability to quarantine packages, with automation being introduced later.

Supporting your ability to Automate Everything via Service Accounts

Service accounts are finally here! One of the most requested features, we’ve rolled these out for all paid plans. Service accounts will allow you to create bot users without associating them with a Human, which will enable us to deliver the promise to help you automate everything (one of our core philosophies). When hooking up your favorite CI tool, like CircleCI, you can use a restricted-access service account to help you automate efficiently.

Introducing scalable usage-based storage and bandwidth

One of the exciting things about artifact management and end-to-end software supply chain is that it is constantly changing. The flow of artifacts from your private CI processes or the pull from open source means that the “catalog” of available artifacts is continuously in flux.

Every time there’s a change, we process those changes. Our team is continually monitoring the stability and security of the Cloudsmith platform. As you scale, we scale. So when we charge for storage and bandwidth, we do so because it’s managed storage and bandwidth.

That doesn’t mean it has to cost the earth, and we listened to your feedback regarding both the tiered scaling of storage/bandwidth pricing and the limits imposed.

The new Cloudsmith plans include the following changes:

Substantially increased the “free” storage and bandwidth you get per tier. Before, each tier had a flat 30GB of storage and 60GB of bandwidth. Now Team provides 50GB of storage and 100GB of bandwidth; for Velocity, it is 200GB of storage and 400GB of bandwidth, and so on.

Removed the hard limit cap for Team and Velocity, which previously would have forced you to move up tiers to unlock more. In other words, there’s no boundary to which you can scale storage and bandwidth.

Active limits for users and entitlement tokens

We’re introducing usage-based limitations to plans for active users and active entitlement tokens for the first time. These are currently for monitoring purposes and won’t be actively enforced until a later date (more on that later). First, let’s define what we mean by “active.”

An “active user” is defined as a user in your organization who interacts with the service, either via the UI or by using their API key, within the current billing period. For example, you may have 30 users invited to an organization, but in the past 30 days, only five have logged in, and only 1 uses their API key, then there would be six active users.

An “active token” (entitlement token) is a token in your repositories that interacts with the service, usually by downloading assets, within the current billing period. For example, if you have 200 customers, but in the past 30 days, only 100 used their token to download software, then there would be 100 active tokens.

These changes are intended to be usage-based later, to facilitate organizational growth without moving up plans (and ensure we’re delivering values at the proper levels, either for internal developers/deployers or external distributors).

The “When are the changes happening?” section later describes the “when” for rollout.

Your plan will vary depending on your organization's needs, your belief in Cloudsmith, and your desire for specific features or outcomes. You may be best staying on the same plan (and, in some cases, better off), or you may wish to either downgrade or upgrade. The first step is to compare your existing plan with the new plans via your organization's

Great! As you know, we love open-source software. If this is your organization, you won’t need to take any action. OSS repositories will continue to access most of the Team plan features as before (excluding SAML and Upstream Proxying). We realize that the active users limit makes this awkward, but they’re not enforced yet and won't be for OSS organizations. We’re likely to move you to a unique OSS plan (or something similar) later that takes care of this. The bottom line is that we support you and will find a home for you at Cloudsmith, no matter what, and you won't need to make any changes.

Your organization is on a Legacy (pre-Team/Velocity/Ultra) plan.

If your organization is on a plan type that predates our Team, Velocity, and Ultra plans, you’ve been supporting Cloudsmith for a long time - and we appreciate that!

There are three key considerations to determine the best plan for your organization:

What are the features your organization needs?

How much storage and bandwidth do you usually need?

Based on those inputs, you may find that downgrading to the Core (free) plan or upgrading to the Team plan suits your needs better. Regardless of your pick, you’ll likely see significant additions to the features. If you need help deciding or want to discuss your options, ask us, and we’ll be happy to help!

The Cloudsmith Team plan increased in cost - but in addition to an increased quota for built-in storage and bandwidth, it also had significant features added to it, including SSO with SAML, service accounts, audit logs, and quarantine.

We believe these new features bring the best essential artifact management and security to the Team plan. However, if your organization does not require these features, or if you’re an individual or small company, you can now consider the Core (free) plan too.

Your organization is on the Velocity plan.

The Cloudsmith Velocity plan increased in cost - but in addition to a significantly increased quota for built-in storage and bandwidth, with an unlimited overage allowed, it’s become the sweet spot for organizations that need advanced insights, control, security, and team management, that aren’t quite yet at a point of requiring Enterprise-grade compliance features.

Suppose your organization does not benefit from the increased storage and bandwidth and doesn’t need the advanced insights, controls, and user/token capacity. In that case, you may want to consider downgrading to the Team plan instead.

The Cloudsmith Ultra plan is best for teams tackling significant problems of scale that need Enterprise-grade compliance, performance, and support. If you are already an Ultra customer, that’s likely because this description matches your needs. Otherwise, if you need a customized quote, you can contact us (see below) to get one that fits your needs.

Beyond Enterprise-grade artifact management, you can access volume-based discounts, an excellent option for customers with high storage and bandwidth needs to control their costs better. We also offer Enterprise-tier support as an add-on, with several benefits, including a first response SLA, rolling support hours, emergency escalation, a dedicated technical account manager, and more.

These changes will affect accounts on their first billing cycle renewal after July 1, 2022. So for those on annual subscriptions, it may be at a much later date. Please check the billing management page for your organization for more details.

We hope that gives adequate time to prepare for the changes, but as with everything related to billing and costing, please reach out if you’d like to discuss the timeline in more detail or need additional help dealing with them.

As for enforcement of the “active” limits (such as active users, active tokens, etc.), these won’t be enforced until 

(a) listen to feedback on these changes before finalization of limits and;
(b) notify you in advance before activating enforcement of the limits, and;
(c) ensure there are dashboards and notifications in place for monitoring first.

We've spent a lot of time and effort crafting plans that enable our customers to get the best out of the Cloudsmith platform. We've listened to feedback and looked at the data, and we hope we've found the right mix of features, limits, and value for each of the tiers.

We hope this post answers all the questions you have, but if you are still unsure what plan is right for you, you can reach us directly 

 for a no-obligation chat. We would be happy to discuss your use case and see how we can ensure Cloudsmith can meet your needs.

Lastly, we want you to join us on the journey as customers, partners, and collaborators; please see 

the personal message about pricing from the founders of Cloudsmith (Alan and Lee)

, which charts that path from inception until today. We 

appreciate your support, and thank you for taking this journey with us.

Pricing: Building A Better Cloudsmith

You know you need to secure your software supply chain. Everyone’s telling you that these days - your executives, your vendors, even 

. Your organization has an initiative to do so, or maybe they’ve brought in an expert to help you achieve this goal. But hold on a minute - do we have a shared understanding of what a software supply chain is, and what exactly makes it secure?

. The focus was getting back to the basics of what a software supply chain is, and why it needs to be secure. If you weren’t able to attend, or if you want reference material to share with others, here’s our recap.

The webinar addressed the following topics:

What does a secure software supply chain look like?

What are Cloudsmith and Chainguard doing to help solve this problem?

In the most basic terms, what is a software supply chain?

Simply put, a software supply chain includes 

 everything that contributes to making your product - the source code, dependencies, systems, tooling, environments, processes, and even the users who contribute along the way.

, Developer Relations at Cloudsmith, said that a good analogy for understanding the software supply chain is to look at another industry that also deals with supply chains - manufacturing. The manufacturing industry has a standardized way - a Bill of Materials - to detail all of the inputs into their final product. They need that because they need to ensure they have the materials required to build the physical product and that they have met safety and security standards along the way.

The software industry doesn’t have the same regulatory controls as manufacturing, though. There is no centralized authority ensuring provenance and traceability are enforced (though we may see this in the future). This gap has made space for the rise of many interesting projects designed to help make safety and security so easy, it becomes the default. Projects like Sigstore, The Update Framework, in-toto, and SLSA are just a few examples. We’ll touch more on these projects later in this post.


Why are we securing our supply chains now?

As Dan Lorenc said in the webinar, there have been voices advocating for securing software supply chains for years now. But a handful of events in the last 24 months have caused organizations to wonder why they’ve waited so long to get started.


In the spring of 2020, SolarWinds unknowingly started to send out software updates that contained hacked code. This is the event that really got everyone talking about “software supply chains”.

SolarWinds is an IT management tools company that helps businesses manage their networks, systems, and infrastructure. In early 2020, threat actors found a way into the build system at SolarWinds and managed to add malicious code into one of its products, a performance monitoring platform called Orion. Subsequently, when Orion customers updated their installations, the malicious code was included in the update, giving the threat actors a backdoor they could use to install additional malicious software, exfiltrate sensitive data, or spy on the companies themselves.

Big organizations found themselves impacted - Microsoft and Intel for example. Overnight, everyone was talking about software supply chains and what needed to be done to secure them.


In February 2021, security researcher Alex Birsan 

 were found to be vulnerable to the injection of malicious packages, via public sources, into their software supply chains.

, and it relies on package management software to download the malicious version of a package being used as a dependency. The key is to create an external library with the same name as a private internal library that a particular company uses in its development pipeline. There are then several ways that a package manager can end up accessing the malicious external version of the library.

This incident shows why it is so important to make security so easy, it happens by default. It only takes one developer with a poorly configured system for the malicious library to gain entry to the organization.

Executive Order on Improving the Nation’s Cybersecurity

On May 12, 2021, President Joe Biden issued an executive order to begin creating federal standards for security of the software supply chain. 

The Executive Order on Improving the Nation’s Cybersecurity

 orders the Department of Commerce and the National Telecommunications and Information Administration to publish minimum requirements for a 

 (SBOM). The SBOM is a record of the components and packages used in building software, whether open-source or commercial, intended to help software end-users to analyze vulnerabilities or issues with the licenses.


In February 2022, The National Institute of Standards and Technology released Special Publication (SP) 800-218, 

Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities

. At the start of 2022, the White House brought together government employees, private sector stakeholders, and members of the open-source community to discuss how to improve the security of open-source software and software supply chains. This publication is the result of those discussions, and it recommends a core set of high-level secure software development practices called the SSDF that can be integrated into each SDLC implementation.

Why is this a hard problem for organizations to solve?

One challenge is that open-source software is foundational to software development, and so for an organization to secure their supply chain, they will need all open-source software they use to also be secure. Realistically, open-source code is in every supply chain. Now, it’s important to note that the way to solve this problem 

 to remove open-source software from your supply chain. In fact, open-source software can often be more secure than proprietary software as its widespread use means it’s usually well tested. The challenge is in how to make adhering to security best practices so easy, they are not burdensome for the open-source community to adopt.

Along the same lines, for one organization’s software supply chain to be secure, the supply chain of any vendor they use also needs to be secure. You need provenance from top to bottom. To quote Paddy Carey, Senior Staff Engineer, Cloudsmith, “

.” And if no one is requiring you to adopt secure software development practices, and it’s overly burdensome to do so, what’s your motivation? So again, designing standards, tools, and solutions that make it easy to be secure will be key to the widespread adoption of secure software development practices.

As Dan Lorenc said, it will be slow until the first person adopts these practices, but then we’ll see it ripple across the industry.


First, it’s important to acknowledge that there is no one thing you can do to secure your supply chain. There are many best practices that come together to create a secure software supply chain. But it’s also important not to let that overwhelm you.

One project that is designed to help organizations understand what makes a supply chain secure and provide guidance on how to get started is 

. It’s a security framework, a checklist of standards and controls to secure packages and infrastructure in your organization. And there are SLSA levels - Level 1 is designed to be easy to achieve to help motivate folks to start the process of securing their supply chain.

NIST organizes the Secure Software Development Framework practices into four groups:

: Ensure that the organization’s people, processes, and technology are prepared to perform secure software development.

: Protect all components of the software from tampering and unauthorized access.

: Produce well-secured software with minimal security vulnerabilities in its releases.

: Identify residual vulnerabilities in software releases and respond appropriately to address those vulnerabilities and prevent similar vulnerabilities from occurring in the future.

Both the SLSA framework and NIST’s SSDF are good starting points for organizations on the journey to a secure software supply chain. And if you want the tl;dr on NIST’s SSDF, 

Dan Lorenc read NIST 800-218 so you don’t have to

Chainguard was founded in 2021 with the mission to 

make the software supply chains secure by default

. The team is working on this goal with a strong commitment to open-source projects and communities, and a willingness to take on large-scale industry-wide changes. Some key projects they are involved in:

As mentioned earlier, SLSA is a checklist of standards and controls to secure packages and infrastructure within an organization. SLSA levels are a common language to talk about how secure software, supply chains, and their components really are. From source to system, the levels blend together best practices to create four compliance levels of increasing assurance.

A new standard for signing, verifying, and protecting software, sigstore automates how you digitally sign and check components, for a safer chain of custody tracing software back to the source, removing the effort, time, and risk of error this usually comes with this.

As Dan McKinney said, Cloudsmith is excited that securing the software supply chain is now at the forefront of people’s minds, as it’s been close to our hearts for a while now. We believe that 

 - the strategy of ensuring all packages produced or consumed are scanned, verified and isolated from untrusted sources - improves security through isolation, automation, and universal hosting. Our platform enables organizations to add continuous packaging to their modern software development workflow.

Provide a single source of truth of software assets

 with support for over 28 formats, allowing organizations to manage packages across languages and formats in one place. This centralized source of truth provides visibility, control and management consistently for all packages produced or consumed by the build process, and gives organizations a single checkpoint that all packages pass through.

The goal of provenance is an unbroken chain of traceability, all the way back to the host machine that built the package. And we want to meet our users where they are when it comes to provenance. We will implement support for the signatures and attestations that our customers are adopting across all the formats we support, including but not limited to sigstore, cosign, in-toto, The Update Framework and more.

users can cache their open-source packages

 away from public upstreams. By caching packages from public upstream repositories and other external sources, you can protect yourself from issues with package availability, license changes, and emerging vulnerabilities.

Cloudsmith blog

Scaling Software Delivery: Continuous Delivery, Overcoming Challenges, and the Power of Cloudsmith

10 Awesome Benefits of Artifact Management and Why You Need It

Recap: 2022 State of DevOps Webinar

Pricing: Building A Better Cloudsmith

Everything You Wanted To Know About Securing The Software Supply Chain

Continuous Software Pipelines: Why Enterprises Are Going Cloud-Native Dev Week Enterprise Open Talk

Getting Started with Continuous Packaging

Package Management for Gaming Software Development

Continuous Software Pipelines: Why Enterprises Are Going Cloud-Native 2021 Dev Week Cloud Keynote

Target, Track and Trace your Vulnerabilities

Integrating a Cloudsmith repository with a Semaphore CI workflow

Integrating a Cloudsmith repository with a Harness CD pipeline