June 2024 Summaries

Cloudsmith has announced its support for the Chainguard Registry as an upstream source, enhancing security and efficiency in artifact management workflows. By consolidating all artifacts, packages, and images into Cloudsmith, organizations can reduce risk of attack, effortlessly deploy and distribute packages, ensure compliance and security, and safeguard their workflows from disruptions caused by repository outages. The integration also offers upstream proxying and caching capabilities, which streamline development processes, enhance performance, and maintain control over dependency management workflows. To integrate the Chainguard Registry into Cloudsmith, organizations can create a repository, configure upstream proxying settings, and pull Chainguard images using Docker native tooling. This integration unlocks a new level of reliability and control in development processes.

In the pre-GitHub era, developers struggled with managing source code management tools such as SVN, CVS, VSS, and RCS, leading to concerns over visibility, control, and maintenance. The emergence of GitHub in 2008 revolutionized source code management with its fully managed SaaS offering, providing developers with visibility, control, and management. Cloudsmith was formed to solve similar challenges for the software supply chain and secure delivery, including binaries, artifacts, packages, and containers, bringing a fully managed SaaS offering to store most of the world's packaged code. Cloudsmith aims to help developers remove the need for an artifact registry on a legacy black box by providing a single source of truth for all artifacts in a cloud-native platform, leveraging cloud benefits such as reduced infrastructure costs and scalability. By integrating with GitHub, users can access features like Single Sign-On, GitHub Actions Integration, OIDC Support, Security Scanning, Policy Management, and Empowering Smarter, Safer Choices through Cloudsmith Navigator, which surfaces curated provenance information about open-source packages powered by GitHub's history of source code.