Upstream Proxy Agent
If you've received requests from a service you maintain with the user agent:
cloudsmith/x.y.z (+https://docs.cloudsmith.com/proxy-agent)Then you may be wondering what that means! If so, you're in the right place.
Cloudsmith is a fully-managed, cloud-native software artifact management SaaS. We provide software supply chain security and artifact distribution for enterprises.
What is an Upstream?
If you've received a request from us with the user agent above, it means that one of our customers has designated your service as an Upstream.
Why our customers use Upstreams
Upstreams allow our customers to proxy and cache artifacts from "upstream" registries in their Cloudsmith repositories. Many of our customers' upstreams point to OSS registries like pypi, or Maven Central.
Using upstreams allows our customers to isolate their processes from issues - such as a registry or artifact becoming suddenly unavailable, which would otherwise cause their builds to fail. Using upstreams also allows customers to scan and inspect artifacts before they get to users - mitigating against supply-chain attacks. Upstreams are critical in helping our customers centralize where their dependencies and software assets are maintained.
Your service as an Upstream
On request, we cache packages from your service in Cloudsmith, then make them available to customers. We interact with your service using the regular/native package manager interfaces, and build an index of available artifacts. We'll periodically re-index to ensure we're working off the most accurate and up-to-date information. We strive to be good partners and obey conventions such as rate limits, with exponential back-off in place for most error handling.
Further Questions
If you have any questions, concerns, or commercial obligations/terms - please Contact Us.
