►
From YouTube: Setup a Private, Secure, Cloud-native, Ultra-fast Repository in 60 sec w/Cloudsmith - Adil Leghari
Description
For more Continuous Delivery Foundation content, check out our blog: https://cd.foundation/blog/
Demo Theater: Setup a Private, Secure, Cloud-native, Ultra-fast Repository in 60-Seconds with Cloudsmith - Adil Leghari, Cloudsmith
JW Grand Ballroom 4
Speakers: Adil Leghari
All your packages, in any format, in one location and accessible across the organization and Globe? Sound too good to be true?
Join Cloudsmith’s Solution Architect Manager, Adil Leghari in the demo theatre as he sets up a private, secure, cloud-native, ultra-fast repository with Cloudsmith. See how you can easily integrate Cloudsmith into your current setup to start handling packages and dependencies the right way.
Cloudsmith is a single, cloud-native, private repository for all your packages. With Cloudsmith, packages are automatically available globally in 225+ points of presence. Imagine your distributed team, working across multiple languages and formats, can now access every software asset across your organization consistently and reliably.
A
Cool
okay,
I
guess
I'll
get
started
because
it
is
around
1
30,
so
welcome.
Everyone
welcome
to
our
talking
time
from
zero
to
repo
in
60
seconds,
with
constant
there's
a
longer
title
in
the
actual
talk.
I
wanted
to
say
the
words
and
this
is:
it
gets
a
point
across
a
little
clear,
so
don't
worry
you're
in
the
right
room.
A
A
You
can
find
me
online
at
the
dillio
on
twitter,
github
socials,
but
I'm
also
live
here
in
wheat
space
and
fully
vaccinated
so
feel
free
to
stop
by
the
booth,
and
you
know,
have
a
quick
chat
and
get
a
free
t-shirt
if
you
want
as
well
so
without
further
ado,
let's
get
started
so
who
are
we
who's
cosmic?
So
we
are
your
universal
cloud-native
artifact
repository.
A
A
Now
I'm
going
to
break
down
these
points
a
little
more
in
detail
later
on
the
talk,
but
for
now
I
want
to
give
you
a
quick
summary
kind
of
because
I
really
don't
want
to
bury
the
lead
here.
I
want
to
get
y'all
right
into
the
demo,
because
once
you
see
how
truly
easy
it
is
to
set
up,
everything
else
is
just
going
to
really
click
and
fall
out
of
the
place.
So
we
are
global
in
that
every
package
uploaded
to
our
platform.
A
A
We
are
secure
and
that
we
support
your
ssls.
You
know
sign
on
the
mfa,
vendors
of
choice.
We
also
provide
fine-grained
access
control
when
we
stand
for
malware
and
cds
for
every
artifact,
and
we
are
universal
in
that
we
support
over
28
package
formats,
even
all
the
same.
Multi-Format
repository
and
we
integrate
with
your
existing
ci
cd
and
security
tooling.
A
So
without
further
ado.
Actually
you
want
to
get
right
into
the
demo
to
show
this
off
a
little
bit,
so
people
can
see
my
screen
there,
I'm
going
to
slide
over
perfect,
and
now
we
we
are
actually
already
logged
in
so
I'm
logged
into
my
gmail
account
here
called
the
deals
demo.
So
for
that
reason
I
can
use
the
google
single
sign-on
link
here,
just
click
there
and
there
you
go,
I'm
already
logged
in.
So
it's
going
to
warn
me
that
I
don't
have
mfa,
obviously
set
up
mfa.
A
If
you
can,
I'm
not
going
to
do
a
good
demo.
Account
first
step
is
to
create
a
new
organization.
So
it's
as
simple
as
this.
We
just
give
it.
The
org
name
demo
in
this
case
define
my
storage
and
bandwidth
requirements
that
these
are
just
the
best
guess,
of
course,
in
an
estimate
you
don't
have
to
be
hard
and
fast
we
grow
with
you,
so
we
have
different
plans
to
master
different
growing
needs
and
I
will
specify
a
use
case
in
this
case.
I'm
centralizing
package
management
across
an
organization.
A
A
A
So
in
here
I
can
give
my
repository
a
name
in
this
case
I'll
just
call
it
demo
I'll
give
a
default
region
which
is
closest
to
me,
I'm
going
to
say,
shall
we
say,
ohio,
sure
why
and
I'll
say
it's
private.
For
now
we
do
support
public
and
open
source
as
well
and
I'll
click
for
you,
and
it
really
just
is
that
simple.
So
within
about
a
minute
I
set
up,
I
logged
in
I
set
up
my
organization
and
my
repository
and
now,
of
course,
what
I
can
do
here
is.
A
A
So
you
can
get
that
set
up
natively
quickly
in
your
own
command
line,
tooling.
So
nice
and
simple,
you
have
everything
in
there
I'm
going
to
spend
a
little
bit
of
time
in
there
before
I
go
back
to
the
slides
just
to
highlight
a
few
more
things.
So
in
my
repository
here,
of
course,
this
again,
if
you
recognize
github,
this
is
a
similar
ui.
I
have
the
ability
to
set
up
access
controls
here.
So
this
is
your
standalone
role
based
access
control.
A
You
have
the
team,
you
have
specific
users
and
certain
default
organization
level
read
write
access
that
you
can
define
in
addition
to
that,
one
of
the
big
security
things
that
we
have
is
entitlements.
So
this
is
one
of
the
great
features
so
think
of
it
as
an
api
token
that
you
can
define
as
read
only
so.
If
I
create
a
token
here,
I
get
a
lot
of
granularity
here
and
control,
so
I
can
set
up
any
search
term.
I
want
I
can
search.
A
I
can
set
restrict
to
search
my
package
name
by
extension
by
version
even
architecture
license
whatever
I
want.
I
can
basically,
if
I
can
think
of
it,
I
can
basically
define
that
search
restriction
for
this
individual
entitlement
token.
So
this
read-only
user
is
only
going
to
get
that
see
those
specific
packages,
any
usage
restrictions.
I
can
define
by,
of
course,
time
window
download,
bandwidth,
ips
and
you
can
get
really
creative
here
so
basically
metadata.
We
let
you
define
any
json
you
want,
so
you
can
actually
fully
define
a
specific
search
term.
A
A
specific
metadata
tag
that
you
wanted
to
search
for
that
only
only
give
visibility
to
those
individual
things.
So
this
is
a
real
like
superpower
of
cloudsmith.
If
you
have
the
granularity
of
being
able
to
control
access
to
your
repository
for
individual
apps
services
of
users
or
even
customers,
a
lot
of
distribution
users
use
that,
in
addition
to
that,
of
course,
we
have
you
can
enforce
the
new
law.
We
have
some
license
compliance
pieces
there
and
also
for
the
license
that
does
not
in
this
individual
repository.
A
But
let's
say,
if
I
go
over
here
to
an
existing
one,
I
look
for
license
compliance
here,
we'll
see
different
licenses
and
it'll
break
it
down
by
different
license
types
and
total
packages.
There
too,
of
course
we
offer
obscene
cracks
upstream
proxying,
so,
if
you're
familiar
with
virtual
repos
or
proxy
repos
and
nexus
or
artifactory,
that's
exactly
the
equivalent
there,
where
we
have
enough
stream,
we've
been
defined
for
certain
repo
text.
Now
that's
available
for
a
handful
of
formats
that
we're
adding
more
as
we
go.
A
I
believe
the
recent
edition,
if
I'm
correct
allison's
in
the
crowd,
is
ruby
right,
which
is
not
truly.
So
that's
great.
Of
course
you
have
web
books
here,
so
you
can
also
drive
web
hooks.
So
when
a
package
is
uploaded
or
other
specific
actions
occur
in
your
repository,
you
can
create
a
web
book
to
drive
an
external
service.
If
you
need
that
to
happen,
then
we
provide
url
and
subscriptions
that
you
can
subscribe
to
as
well.
A
So
I'm
going
to
bounce
back
the
slides
here,
but
if
y'all
have
any
questions
feel
free
to
shout
them
out.
I
can
stop
at
any
point,
so,
let's
swap
over
here,
get
back
to
the
demo.
So
let's
talk
about
the
points
that
I
made
earlier
a
little
bit
more
so,
firstly,
we
talked
about
that
package
delivery
network
for
pdm,
so
those
225
plus
points
of
presence
that
are
highly
available
globally.
A
A
So
what
this
means
is
that
your?
If
your
goal
is
to
collaborate
on
the
code
with
a
globally
distributed
dev
team
or
to
distribute
your
packaged
artifacts
to
your
international
customer
base,
we've
got
you
covered
either
way.
So
you
can
really.
We
meet
multiple
use
cases
in
terms
of
that
distribution
network
and
you
don't
pay
any
extra
for
this
piece
of
the
business
tablespace.
Everybody
gets
this,
so
we
are
a
cloud-native
platform,
as
I've
said
before
again
board
in
the
cloud
fully
managed
and
scalable.
A
So
let
us
stress
about
that:
set
up
patching
and
maintenance
for
you
of
the
back
end
and
allow
you
and
your
devs
to
stay
productive
and
focused
on
that
core
mission
of
delivering
your
apple
service
and
also
for
your
peace
of
mind.
Of
course,
we
back
our
service
with
world-class
engineer,
driven
enterprise
level
support.
A
So
we
talked
about
security.
Cloudsmith
is
a
key
component
of
securing
your
software
supply
chain.
So
we
accomplished
this
in
several
ways,
but
I'm
just
going
to
highlight
a
few
here,
as
I
mentioned
before,
you
know
you
can
control
access
to
your
cloud.org.
You
can
gate
it
by
a
single
sign-on
provider
of
choice,
whether
that's,
google,
microsoft,
amazon
octa
github
or
even
your
internal
saml
sso
provider,
but
we
support
it.
We
obviously
also
support
multi-factor
authentication
and
multiple
role-based
asset
control
models.
A
We
also
offer
these
service
accounts
service
accounts
as
a
recent
release
to
be
able
to
have
definable
accounts
specifically
for
pipeline
based
access,
as
well
as
those
api
title
tokens
that
I
talked
about.
So
the
entitlement
tokens
are
that
fine
grade
flexible
option.
You
know
you
can
control
it
from
all
different
ways
of
restricting
package
access,
including
custom
metadata.
A
So
if
you
all,
are
fans
of
chain
guard
and
safe
store
and
cosign,
if
we
now
support
the
ability
to
store
your
generated
s-bombs
alongside
your
image
as
well,
and
we
remain
committed
to
do
that
for
every
package
format
that
comes
out
with
s-bond
support
and
of
course.
Finally,
we
are
that
universal
artifact
platform
and
we
really
lean
into
the
universal
part
here.
So
classmates
supports
over
28
plus
package
formats,
including
dev
rpm,
new
get
paid,
npm
docker
and
many
many
more.
A
We
even
offer
a
raw
format
for
your
custom.
Packaging
needs
as
well.
We're
also
unique
in
that.
We
give
you
the
flexibility
of
hosting
all
these
different
package
components
in
the
same
multi-format
repository.
So
we
speak
your
language
and
abstract
away
the
complexity
of
those
multiple
metadata
feeds
on
the
back
end
for
your
native
tooling.
But
the
real
important
point
here
is
flexibility,
so
it's
not
necessary
that
you
put
all
your
packages
in
the
same
repository.
A
The
real
point
is
it's
flexible
as
it
is
up
to
you,
so
you
can
define
how
your
organization
groups
your
artifacts,
whether
that's
dev,
staging
or
fraud
for
pipeline-based
access
or
even
split
by
teams.
You
just
have
the
freedom
of
choice
here
and
as
well.
We
of
course
also
integrate
with
your
existing
cicd
vendors
out
there,
so
the
certain
ci's,
the
artists,
the
githubs,
even
octopus,
but
also
iit
vendors
like
terraform,
and
additional
security
and
observability
vendors
out
there
too.
A
So
if
your
vendor
of
choice
isn't
on
the
list
not
to
worry,
because
we
have
multiple
methods
of
interacting
with
our
platform,
we
have
a
well-documented
api
and
we
have
this
nice.
Try
it
now
api
reference
in
our
docs
that
you
can
play
with.
In
addition,
we
support
native
command
line
tools
for
every
format,
so
like
npm
or
nuget
or
docker
commands
are
going
to
work
daily.
Yes-
and
we
also
offer
our
own
suspense
cli,
if
you
want
to
prefer
to
use
a
dedicated
tool
for
your
for
your
own
pipelines,.
A
And
so
this
last
slide
is
just
kind
of
leading
into
the
idea
of
a
universality
right.
We
have
ci
cd
tools
out
there
like
circle,
ci
github.
We
have
observability
tools
like
splunk
or
data
dog
or
slacker
urban
honeycomb.
We
have
security
tools
like
sneak
and
obviously
infrastructure
tools
like
ansible,
puppet
aws,
terraform
and,
of
course,
all
those
different
package
formats.
So
we're
really
looking
to
solve
that
problem
of
having
a
disparate
team,
with
lots
of
different
formats
that
you're
dealing
with.
A
If
you
have
a
team
of
developing,
you
know
maven
code
over
here
and
you
have
a
team,
that's
working
on
docker
images.
Wouldn't
it
be
nice
if
you
could
actually
have
that
all
in
the
same
repository
have
that
observability
for
your
c-level
staff
to
move
in
and
see
exactly
what
your
package
distribution
is
like,
and
you
know
whether
you're
meeting
security
compliance
for
all
those
different
formats,
so
yeah.
So
that's
my
demo.