You can use boolean logic (e.g. AND/OR/NOT) for complex search queries. For more help and examples, see the search documentation.
Search by package name:
my-package (implicit)
name:my-package (explicit)
Search by package filename:
my-package.ext (implicit)
filename:my-package.ext (explicit)
Search by package tag:
latest (implicit)
tag:latest (explicit)
Search by package version:
1.0.0 (implicit)
version:1.0.0 (explicit)
prerelease:true (prereleases)
prerelease:false (no prereleases)
Search by package architecture:
architecture:x86_64
Search by package distribution:
distribution:el
Search by package license:
license:MIT
Search by package format:
format:deb
Search by package status:
status:in_progress
Search by package file checksum:
checksum:5afba
Search by package security status:
severity:critical
Search by package vulnerabilities:
vulnerabilities:>1
vulnerabilities:<1000
Search by # of package downloads:
downloads:>8
downloads:<100
Search by package type:
type:binary
type:source
Search by package size (bytes):
size:>50000
size:<10000
Search by dependency name/version:
dependency:log4j
dependency:log4j=1.0.0
dependency:log4j>1.0.0
Search by uploaded date:
uploaded:>"1 day ago"
uploaded:<"August 14, 2022 EST"
Search by entitlement token (identifier):
entitlement:3lKPVJPosCsY
Search by policy violation:
policy_violated:true
deny_policy_violated:true
license_policy_violated:true
vulnerability_policy_violated:true
Search by repository:
repository:repo-name
Search queries for all Debian-specific (and related) package types
Search by component:
deb_component:unstable
Search queries for all Maven-specific (and related) package types
Search by group ID:
maven_group_id:org.apache
Search queries for all Docker-specific (and related) package types
Search by image digest:
docker_image_digest:sha256:7c5..6d4
(full hashref only)
Search by layer digest:
docker_layer_digest:sha256:4c4..ae4
(full hashref only)
Field type modifiers (depending on the type, you can influence behaviour)
For all queries, you can use:
~foo for negation
For string queries, you can use:
^foo to anchor to start of term
foo$ to anchor to end of term
foo*bar for fuzzy matching
For number/date or version queries, you can use:
>foo for values greater than
>=foo for values greater / equal
<foo for values less than
<=foo for values less / equal
Need a secure and centralised artifact repository to deliver Alpine,
Cargo,
CocoaPods,
Composer,
Conan,
Conda,
CRAN,
Dart,
Debian,
Docker,
Go,
Helm,
Hex,
LuaRocks,
Maven,
npm,
NuGet,
P2,
Python,
RedHat,
Ruby,
Swift,
Terraform,
Vagrant,
Raw & More packages?
Cloudsmith is the new standard in Package / Artifact Management and Software Distribution.
With support for all major package formats, you can trust us to manage your software supply chain.
cloudsmith
(Cloudsmith)
/
api
—
GitHub Project
These tend to be pre-releases, for stable releases download from PyPi: https://pypi.python.org/pypi/cloudsmith-api
Tool-Specific Instructions
Although we use GPG (and RSA) keys across each repository and package format, client-side tools might have specific instructions that differ (or require manual steps). To add or use the signing key for these tools, please click on the package format specific tabs above.
Public GPG Key
GPG-based keys/signatures are used by:
The public GPG key for the cloudsmith/api is:
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1
mQENBFoSvuYBCACwvBPKxyaghAD9iF4Flc/qSRzJOjGenfE01xqhsipV9h9BWTbj
EwB8G/XJr0TKkrrwlJfn7eTk6hkrwbWsI15W++TcIJcsGaoZxvTz1jQpVRdLScse
R7dKZbgiSboeFlRhJjREMXRqXb9XMjzTKVSzIoxJNSnesRG6+nCcuh5sTZHRhvBo
6MKiWHG2oPKTVZXZbU9/KF3dpLbYJSFPYVJOU1xi8taQVxVD5QfAVIBXNzhZuIu4
3lGuLuDDU+cKxN8I3Ap88KkwDdOFnefUApwsZZkMDndNFQDknWoZhEspeRvkJt5Q
nDLAeau6qB3FA4Wsfduv8WwBl2EDH/5njqmHABEBAAG0O0Nsb3Vkc21pdGggUGFj
a2FnZSAoY2xvdWRzbWl0aC9hcGkpIDxjb250YWN0QGNsb3Vkc21pdGguaW8+iQE3
BBMBCAAhBQJaEr7mAhsvBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEBzOrfMW
8oKUwggIAI+YHSX0exK37YyYwteDVHcB26UxcRAyRgnZ3Ehp/cQuSVy87ix4vUMs
cwJsP/uDCiGN4zebXoSUsFaXg1MhCGxzyLZjICY25ZiShk/CTkaIs9k8m8OZqd2/
cXbedxS7t5CBJ+IaKrO3hFr1z0VOiaSOiZ/kDhcTYeNeTDwSeA9ZP1wBTUmNJCRy
cd6ks6hNQRxNcSc0Hx8kyB3HJdGmwmJMh/0ZbzhhuUNtpjibTKwqKQpq/JA3xo6o
3b9iV1OK0OSBreVd6RYa4zaqk0P0CT/wNHx/iT0szccHs/h3WUqFkkizRSazZBM4
kHePkT83pb2y1dUfR8ubvpLBTcGuF3s=
=mTEO
-----END PGP PUBLIC KEY BLOCK-----It has the following long (20 bytes) and short (8 bytes) fingerprints:
05373EC0BE1A3D35D8240F531CCEADF316F282941CCEADF316F28294You can download the GPG key or fetch it via the command-line:
curl -1sLf 'https://dl.cloudsmith.io/public/cloudsmith/api/gpg.1CCEADF316F28294.key'Public RSA Key
RSA-based keys/signatures are used by:
The public RSA key for the cloudsmith/api is:
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAl8L5CAzxxTNyf2ykbQVR
dbxftJQAXwmwngjf8I92Sf2VewGlQ/yn1kX9KXWqulSBBQ+KZc3i5u33c9eygsge
S2pIj1SdgY8n/QkSWcqKYYUyVMqvyaaHj03BeHkL4UQ1H0jv6ystw56wTD8lwr0t
rRqXLpxBivmW7W3hYtNJtKPHq4LZC7FMfTbQa6SIwP7sEwiSZ4SMTc7z4xUabDmQ
Dj3FUHn1HHryTPquCsUcA9H9arsC+gj/E6mKJjU9fPL3oHkoQ42mFHmyk73SYsgw
W1dLARe67NnnpHrsXwFh4l9Bda/52/Lbn9G7Ag3UTb83DjhIOMcELlaQyk8HXvgX
gwIDAQAB
-----END PUBLIC KEY-----It has the following long (16 bytes) and short (8 bytes) fingerprints:
FC9F0E3C86CE108BE5BC4F44A936D9EBE5BC4F44A936D9EBYou can download the RSA key or fetch it via the command-line:
curl -1sLf 'https://dl.cloudsmith.io/public/cloudsmith/api/rsa.E5BC4F44A936D9EB.key'Need Help?
If you couldn't find what you needed in our documentation, then you can always chat to a member of our team instead. It's our mission to be your dedicated off-site team for package management, and we mean it. Come and chat with us, anytime.
What's this page? All Cloudsmith repositories and packages are signed using GPG (or RSA) keys where supported. GPG (or RSA) signatures and checksums provide reliable mechanisms to ensure that the packages that you download/install are neither corrupt nor modified. GPG is generally preferred, but RSA is used for some package formats (such as Alpine). Learn more in the signing keys documentation.
