June 2021 Summaries

To get started with Go modules and Cloudsmith, one can create a new Go module by defining a `go.mod` file. A private Cloudsmith repository can be created to host the module, which allows for secure and version-controlled distribution of the module. Once the module is pushed to the repository, it can be pulled as a dependency in another Go project using the module's URL. This enables developers to share and reuse their code efficiently, while also ensuring that dependencies are up-to-date and secure. By leveraging Cloudsmith, developers can easily manage and distribute their Go modules, streamlining their development workflow.

Cloudsmith is a platform engineering tool that offers features such as cloud-native artifact management, zero trust security, and dependency firewall, designed to help developers manage their software supply chain securely and efficiently. The platform provides a developer-first experience with tools like Cloudsmith Navigator, and supports various formats including Docker, NPM, Python, and Swift. It also integrates with popular CI/CD tools such as Bitbucket CI/CD, Buildkite, and GitHub Actions, and offers solutions for reducing infrastructure costs, securing software supply chains, distributing software globally, and increasing developer productivity. Cloudsmith has customer success stories from notable companies like Kong and PagerDuty, and provides a free platform engineering report that highlights its benefits and features.

Terraform is an open-source tool created by Hashicorp that enables users to manage components in their architecture, including configuration of services and software run on those services. It allows for reproducible creation, update, and destruction of instances with a single command. Terraform's private module registry, supported by Cloudsmith, enables developers to share custom modules among teams, utilize private modules without storage overhead, distribute private modules as commercial offerings, make modifications to public packages while controlling their publication, capture the exact state of modules at a particular version, and control access at an organization, repository, and module level. With Cloudsmith's support, users can create and upload Terraform modules with ease, using tools like tar and the Cloudsmith CLI.

The text highlights the movement towards cloud computing and the benefits of using cloud-native software over traditional on-premise software. Cloud-native software is designed to take advantage of modern cloud computing technologies, providing scalability, flexibility, security, and cost savings. In contrast, on-premise software relies on dedicated resources and infrastructure, which can be inflexible and expensive. The text also emphasizes the importance of selecting cloud-native tools, such as package management tools like Cloudsmith, to fully leverage the benefits of cloud computing. By making the switch to cloud-native software, businesses can empower innovation, stay secure, reduce costs, and scale as their business needs change.

The SolarWinds incident in 2020 highlighted the vulnerability of software supply chains, where threat actors breached build systems and inserted malicious code into widely used products like Orion, affecting tens of thousands of companies. Since then, similar breaches have occurred, including attacks on public package repositories, development tools like CodeCov, and Microsoft's Winget registry, demonstrating that software supply chain attacks are not new but are escalating in frequency and severity. The increasing sophistication of threat actors is attributed to users' growing awareness of software security best practices, which has led them to target the software development process itself, rather than individual users and systems. The blast radius of such attacks is much greater, offering a significantly larger return on investment for attackers. To mitigate this, Continuous Packaging and other best-in-class tools can provide visibility, control, and trust over software packages and code used in environments. Governments are also taking steps to improve the security of software supply chains through guidelines and minimum standards for vendors.

A short demo of how to get started with Unity packages and Cloudsmith, including pushing a package to a private Cloudsmith repository and then adding a package to a Unity project.` This tutorial provides a step-by-step guide on getting started with Unity packages and Cloudsmith. It covers the process of setting up a private Cloudsmith repository, creating a new package, and publishing it to the repository. The demo also shows how to add the published package to a Unity project.