You can use boolean logic (e.g. AND/OR/NOT) for complex search queries. For more help and examples, see the search documentation.
Search by package name:
my-package (implicit)
name:my-package (explicit)
Search by package filename:
filename:my-package.ext
Search by package tag:
tag:latest
Search by package version:
version:1.0.0
prerelease:true (prereleases)
prerelease:false (no prereleases)
Search by package architecture:
architecture:x86_64
Search by package distribution:
distribution:el
Search by package license:
license:MIT
Search by package format:
format:deb
Search by package status:
status:in_progress
Search by package file checksum:
checksum:5afba
Search by package security status:
severity:critical
Search by package vulnerabilities:
vulnerabilities:>1
vulnerabilities:<1000
Search by # of package downloads:
downloads:>8
downloads:<100
Search by package type:
type:binary
type:source
Search by package size (bytes):
size:>50000
size:<10000
Search by dependency name/version:
dependency:log4j
dependency:log4j=1.0.0
dependency:log4j>1.0.0
Search by uploaded date:
uploaded:>"1 day ago"
uploaded:<"August 14, 2022 EST"
Search by entitlement token (identifier):
entitlement:3lKPVJPosCsY
Search by policy violation:
policy_violated:true
deny_policy_violated:true
license_policy_violated:true
vulnerability_policy_violated:true
Search by repository:
repository:repo-name
Search by last download date:
last_downloaded:<"30 days ago"
last_downloaded:>"August 14, 2022 EST"
Search queries for all Debian-specific (and related) package types
Search by component:
deb_component:unstable
Search queries for all Maven-specific (and related) package types
Search by group ID:
maven_group_id:org.apache
Search queries for all Docker-specific (and related) package types
Search by image digest:
docker_image_digest:sha256:7c5..6d4
(full hashref only)
Search by layer digest:
docker_layer_digest:sha256:4c4..ae4
(full hashref only)
Search queries for all Generic-specific package types
Search by file path:
generic_filepath:path/to/file.txt
Search by directory:
generic_directory:path/to
Field type modifiers (depending on the type, you can influence behaviour)
For all queries, you can use:
~foo for negation
For string queries, you can use:
^foo to anchor to start of term
foo$ to anchor to end of term
foo*bar for fuzzy matching
For number/date or version queries, you can use:
>foo for values greater than
>=foo for values greater / equal
<foo for values less than
<=foo for values less / equal
Need a secure and centralised artifact repository to deliver AI Skills,
Alpine,
Cargo,
CocoaPods,
Composer,
Conan,
Conda,
CRAN,
Dart,
Debian,
Docker,
Generic,
Go,
Helm,
Hex,
HuggingFace,
LuaRocks,
Maven,
MCP,
Nix,
npm,
NuGet,
P2,
Python,
RedHat,
Ruby,
Swift,
Terraform,
Vagrant,
VSX,
Raw & More packages?
Cloudsmith is the new standard in Package / Artifact Management and Software Distribution.
With support for all major package formats, you can trust us to manage your software supply chain.
Tool-Specific Instructions
Although we use GPG (and RSA) keys across each repository and package format, client-side tools might have specific instructions that differ (or require manual steps). To add or use the signing key for these tools, please click on the package format specific tabs above.
Public GPG Key
GPG-based keys/signatures are used by:
The public GPG key for the ractive/hoppy is:
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQGNBGpR+ZwBDAD1JfMmgUYUjEdwsF9JJza6UXaNV3Xf+jN8/Fr6V0FsTi9aSG4l
yu2JxIzku2NeNV8OE9rLz4PqVZ/uV2c0upPr0uUURwo0EMJ9fUlBzdYlVNOWEEdi
2Mjo7vA3fhgzwYcdQdnlV3t/zR6TXGeSkmwUDTUaygoSmfIP22jRfbg+MJ9w9/qR
N/qSd4hBnkSHEOIft+YCtAULGXdX+H4Pz19ir6cDoIi2lb3up0PhuKpqSTS+RDuq
sBeEQR+G0vmgRrECubmky7uk0sezypaeh3ZeQrdMZrk01hyIFvY5LK/Y6rxwSaPY
JOHFyw+ckfZDyl6EG+0ZFVQIs5T48ZF7IBkesr6/8lIp48Y7G5DvG3+11w3+oQOk
7BplyFam2Eqb6IpQEBrg96I09kr0bwS2atDB9kUZVq3vBT351YR8zggezoFDGMB7
drL3EY9gzLBycD0tuaV13N2nE4W/5VWVkwU1p55ydqJmGagnM7Si73ZpPSB2zvDo
uXC2p2SoSh0VUg8AEQEAAbQ6Q2xvdWRzbWl0aCBQYWNrYWdlIChyYWN0aXZlL2hv
cHB5KSA8c3VwcG9ydEBjbG91ZHNtaXRoLmlvPokBzwQTAQgAORYhBJBo8xCBDSGl
nCGNVjem9FrOOUtUBQJqUfmcAxsvBAULCQgHAwUVCgkICwUWAgMBAAIeBQIXgAAK
CRA3pvRazjlLVCtLDADxIWEpIzTw2Glcw7HQnzSpMqwyoZxUSvEbiXYcDRqFCgAG
HZy57o0GwfJk01R3e5Rub9D1Gve+qQNSeKlCD6NqE5T8FNAJ4cYuAs58XVredXQ5
hQaS1pEWYhs4g5NytRMB4v3ZwLpTuYv5bZzu4NCevea5hSsVTUTThKmOjXQapjC6
L9VWeTuTvgmMUdMehMXSlmEooBTEwqef0wV6831C7C7nYeR6AkdsmTOwKx2F0T6R
j0YbKykEHIg9ScN1msnaY9S7mRWAkSqwkPXbF6DxZ6KNubfBPRknXTr5POaTW9ks
VfbOVocLTKeUUQiffkTBeLzUGexORUrgSqgNCkHib2gjmE7A1RGEfnJNVhoCdzxR
SBMSpzk2O8N2fzbwISiz4IzOp5wPd5wIrG78lThlszcw1Q0vRuIzFZBTcCbvh9Wx
EUVz+GzDNU0UI9jd1AO2HFlYDlZSkT5i+QpjfhpWIwe4r1LcrTDr03p4i+sHc/CI
iKPP7CrWycu7TxZgT88=
=sacy
-----END PGP PUBLIC KEY BLOCK-----
It has the following long (20 bytes) and short (8 bytes) fingerprints:
9068F310810D21A59C218D5637A6F45ACE394B54
37A6F45ACE394B54
You can download the GPG key or fetch it via the command-line:
curl -1sLf 'https://dl.cloudsmith.io/public/ractive/hoppy/gpg.37A6F45ACE394B54.key'
Public RSA Key
RSA-based keys/signatures are used by:
The public RSA key for the ractive/hoppy is:
-----BEGIN PUBLIC KEY-----
MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA00hARTixdxBsgkr9VqGZ
edwxhfLdsAHG8kbtT/KevpkaaJtzu61uO+5aXUkTm6KkwpceCHxvLGc21V4DxFsd
xtLpGt9OXchPEdkytlK4WAQS8/NRYPP/YKS1JzArufY4NN3i33JFoHwebnLuVyTz
pSNgjXqtlGmoAhQdwlLYOoeOFUHcaeaInI+89ZCQCHNQ1vuptuLOBDIWdRGEK6AH
KxzYu5Jm+WyDvzFIePq6YShP2Gcufcr8E8CGwPfAE5dd7q55jLjFlP6nyA1988dF
9HD8aKFDY4oO6v8Bu0l73Exsh8J5nwfSS5pe2rNQ4XNSlFY411e55efeqpUm7dRA
FxAyFcS7FUN0zaN3LB5hCsJEk5LYYqqwxBd3QulpDa8pf9kqOhuRud0OukCkPW7S
M906Ksii7M1BYQxoQeTku+P3+oIkPTAZSOT51qPFSMULpMsEO0iWG9thSIQw5G8o
+MqLXjXCA89M1RYVtrY+HTxIo727S+n6NJ4O+BOCiZfJAgMBAAE=
-----END PUBLIC KEY-----
It has the following long (16 bytes) and short (8 bytes) fingerprints:
72AE968B8CEF2C2C19BB12D8D185295B
19BB12D8D185295B
You can download the RSA key or fetch it via the command-line:
curl -1sLf 'https://dl.cloudsmith.io/public/ractive/hoppy/rsa.19BB12D8D185295B.key'
Public ECDSA Key
ECDSA-based keys/signatures are used by:
The public ECDSA OpenSSH key for the ractive/hoppy is:
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwSrAzjBqL8TKHb3xFu67EvnA7ccO
ipaD/qJLYU5l2hteIWMm8Ix05BPsgulEw1JDNIGkhrGIn/IDgtqFjOwvxw==
-----END PUBLIC KEY-----
It has the following long (16 bytes) and short (8 bytes) fingerprints:
F60C1EA2BCE2C7057877044F3D337C36
7877044F3D337C36
You can download the ECDSA key or fetch it via the command-line:
curl -1sLf 'https://dl.cloudsmith.io/public/ractive/hoppy/ecdsa.7877044F3D337C36.key'
Please note however that the NPM client does not require this key to be installed system-wide in order to allow for package verification - NPM tooling will handle keys automatically.
Public Ed25519 Key
Ed25519-based keys/signatures are used by:
The public Ed25519 key for the ractive/hoppy is:
-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAmDoZ4/yiRmayt9jV30Wi79aLpvFAxo2JMebn6oIL23A=
-----END PUBLIC KEY-----
It has the following long (32 bytes) and short (8 bytes) fingerprints:
6309991A2868CDBC5567FCCA2B05278D4AD90F580A75F365E4C6B71ADD8C6A57
E4C6B71ADD8C6A57
You can download the Ed25519 key or fetch it via the command-line:
curl -1sLf 'https://dl.cloudsmith.io/public/ractive/hoppy/ed25519.E4C6B71ADD8C6A57.key'
For Nix, add this name:base64 line to trusted-public-keys:
ractive-hoppy-30387:mDoZ4/yiRmayt9jV30Wi79aLpvFAxo2JMebn6oIL23A=
Need Help?
If you couldn't find what you needed in our documentation, then you can always chat to a member of our team instead. It's our mission to be your dedicated off-site team for package management, and we mean it. Come and chat with us, anytime.
What's this page? All Cloudsmith repositories and packages are signed using GPG, RSA or ECDSA keys where supported. Signatures and checksums provide reliable mechanisms to ensure that the packages that you download/install are neither corrupt nor modified. GPG is generally preferred, but RSA or ECDSA is used for some package formats (such as Alpine or NPM). Learn more in the signing keys documentation.