When designing upstream support for Cloudsmith, we always strived to ensure that we could build an understanding of every package available on a remote repository. This information is beneficial, helping inform performance, analysis, and security decisions.
With this in mind, we're happy to announce an essential improvement to upstream support for the Maven package format! Cloudsmith now performs indexing against upstreams, using a 'just-in-time' strategy. This allows us to build awareness of artifacts on a remote Maven repository and the versions available when packages are cached from an upstream to a Cloudsmith repository.
As a result of this improvement, we're now able to present the union of various package versions for an individual artifact, irrespective of whether that version is local to your Cloudsmith repository or spread over several upstreams. Additionally, proxy performance when using upstreams, particularly for artifacts that the service is aware of, will be significantly improved.
This is just one of the many improvements we intend to make to our upstream support in the future. Watch this space; we can't wait to show what else we have been working on!
Good news! We have added additional functionality to the Cloudsmith API and CLI to enable you to search for dependencies (such as the ever-dreaded log4j) across packages stored within Cloudsmith repositories.
The syntax is dependency:
On 10th December 2021, a critical severity Remote Code Execution (RCE) exploit disclosure for log4j was published, as CVE-2021-44228, affecting versions below 2.15.0. The vulnerability has been coined as Log4Shell. The log4j framework allows Java developers to log data (incl. user-based) in their applications. Is Cloudsmith impacted? In short: No…
After nearly a year of effort in which we designated 2021 as the “Year of Security,” we’re incredibly proud to announce that we are now ISO27001:2013 certified. The certification is an incredible achievement by the team at Cloudsmith and excellent news for all of our customers. What exactly is ISO27001:2013? ISO27001:2013, also known as ISO27001…
One of the features our customers have requested is the ability to sort packages when querying via the Cloudsmith API. Good news everyone - we can now offer that functionality! What does this mean for me? By default we will sort packages by the uploaded date descending (the most recently uploaded package first), but what if you wanted to view w…
Our more observant Debian users may have noticed that we rolled out support for acquire-by-hash over the past week - you may have also noticed fewer pipeline disruptions as a result! What does this mean for me? If you're someone spinning many plates, you may have encountered some hiccups with your pipeline when updating your repository whilst sim…
Good news! As part of our efforts to further secure access for users in your org, we're introducing the ability to enforce SAML-only Authentication. Plus, a bonus is that SAML is now fully self-service configurable: With SAML-only Authentication configured, all members of your organization will no longer be able to use password-based or social-bas…
By submitting this form, you agree to our privacy policy
