Cloudsmith

Cloudsmith is a fully managed, cloud-native artifact management platform that provides a single source of truth for software packages, containers, and ML models. It addresses the problem of artifacts being pulled from registries outside an organization's control by scanning every package for known vulnerabilities, malware, and license violations, blocking items that fail policy, and logging what shipped where.

The platform supports 30+ package formats plus raw files, with a Docker-compatible and OCI-compliant container registry, multi-format repositories, and upstream proxying and caching. Security features include continuous risk detection, policy management written in OPA Rego, package quarantine and promotion workflows, cooldown policies, license policy enforcement, package signing, SAML/SSO with SCIM provisioning, role-based access controls, and a full audit trail. Observability tools cover analytics, usage insights, log exports, and a Logs API. Distribution runs through a global network with edge caching, fault tolerance, and read-only distribution tokens, while Broadcasts publish software via a customizable interface. Integrations span CI/CD tools such as GitHub Actions, GitLab CI/CD, and Jenkins; identity providers including Okta, Azure AD SSO, and Google SSO; and notifications like Slack and Microsoft Teams, alongside a REST API, CLI, webhooks, and a VS Code extension.

Cloudsmith is aimed at enterprise software teams managing secure supply chains and global software distribution. It is offered as a fully managed service with a free trial available, and an Ultra edition that includes SLAs.