September 2021 Summaries

Cloudsmith has secured $15 million in funding to continue building its best-in-class technology for software engineers, focusing on cloud-native package management and providing a secure single source of truth for all software artifacts. The platform aims to tackle the complexity of managing software assets, enabling customers to track and control the distribution of any software asset and minimize risks associated with open-source software. With this funding, Cloudsmith plans to grow its team, deliver on its product roadmap, and expand into international markets, positioning itself as a leader in cloud-native supply chain management.

Software package repositories are evolving to meet modern development needs, which involve managing dependencies, security, compliance, and distribution across multiple languages, containers, and regions. The goal is to provide a single source of truth for software packages, allowing developers to store, manage, and distribute their packages securely and efficiently. Package managers play a crucial role in creating, uploading, installing, upgrading, and configuring software packages, while package repositories serve as central storage locations for these packages. Multiformat repositories allow storing packages of different types in one repository, reducing the need for multiple repositories to manage. Public and private package repositories exist, with public ones providing easy access to open-source software but lacking control over availability and security. Private repositories offer additional features such as signing packages, single sign-on, and custom domains, making them ideal for enterprises and organizations requiring strict security and compliance. Package upstreams enable consuming packages from external public repositories while maintaining isolation from untrusted sources. Signing packages with GPG/RSA keys ensures trust in the software package, and recent efforts like CNCF's Sigstore Project aim to improve transparency and simplification of signing processes. SBOM (Software Bill of Materials) and SPDX (Software Package Data Exchange) provide standardized ways to communicate SBOMs, enabling vulnerability and license analysis of software packages. Package license compliance is critical, with package managers matching licenses defined within a package's metadata as accurately as possible. Private package repositories enable software distribution, providing reliable and fast package delivery, control over downloads, and gathering metrics on downloads. The Package Delivery Network (PDN) is a customized CDN that delivers packages faster to distributed users. As the software landscape evolves, modern package repositories must address complex challenges such as scaling, security, and distribution.

Modern applications rely on open source libraries, runtimes, databases, and base images as raw materials, making them vulnerable to software supply chain attacks. The increasing use of open source components in codebases has created a need for reliable tools to ensure security, compliance, and provenance of software and its dependencies. To address this, developers can learn from practices and tools like finding and fixing known vulnerabilities, building a source of truth for open source packages, and combining continuous packaging and security into a delivery pipeline.