You can use boolean logic (e.g. AND/OR/NOT) for complex search queries. For more help and examples, see the search documentation.
Search by package name:
my-package
(implicit)
name:my-package
(explicit)
Search by package filename:
my-package.ext
(implicit)
filename:my-package.ext
(explicit)
Search by package tag:
latest
(implicit)
tag:latest
(explicit)
Search by package version:
1.0.0
(implicit)
version:1.0.0
(explicit)
prerelease:true
(prereleases)
prerelease:false
(no prereleases)
Search by package architecture:
architecture:x86_64
Search by package distribution:
distribution:el
Search by package license:
license:MIT
Search by package format:
format:deb
Search by package status:
status:in_progress
Search by package file checksum:
checksum:5afba
Search by package security status:
severity:critical
Search by package vulnerabilities:
vulnerabilities:>1
vulnerabilities:<1000
Search by # of package downloads:
downloads:>8
downloads:<100
Search by package type:
type:binary
type:source
Search by package size (bytes):
size:>50000
size:<10000
Search by dependency name/version:
dependency:log4j
dependency:log4j=1.0.0
dependency:log4j>1.0.0
Search by uploaded date:
uploaded:>"1 day ago"
uploaded:<"August 14, 2022 EST"
Search by entitlement token (identifier):
entitlement:3lKPVJPosCsY
Search by policy violation:
policy_violated:true
deny_policy_violated:true
license_policy_violated:true
vulnerability_policy_violated:true
Search by repository:
repository:repo-name
Search queries for all Debian-specific (and related) package types
Search by component:
deb_component:unstable
Search queries for all Maven-specific (and related) package types
Search by group ID:
maven_group_id:org.apache
Search queries for all Docker-specific (and related) package types
Search by image digest:
docker_image_digest:sha256:7c5..6d4
(full hashref only)
Search by layer digest:
docker_layer_digest:sha256:4c4..ae4
(full hashref only)
Field type modifiers (depending on the type, you can influence behaviour)
For all queries, you can use:
~foo
for negation
For string queries, you can use:
^foo
to anchor to start of term
foo$
to anchor to end of term
foo*bar
for fuzzy matching
For number/date or version queries, you can use:
>foo
for values greater than
>=foo
for values greater / equal
<foo
for values less than
<=foo
for values less / equal
Need a secure and centralised artifact repository to deliver Alpine,
Cargo,
CocoaPods,
Composer,
Conan,
Conda,
CRAN,
Dart,
Debian,
Docker,
Go,
Helm,
Hex,
LuaRocks,
Maven,
npm,
NuGet,
P2,
Python,
RedHat,
Ruby,
Swift,
Terraform,
Vagrant,
Raw & More packages?
Cloudsmith is the new standard in Package / Artifact Management and Software Distribution.
With support for all major package formats, you can trust us to manage your software supply chain.
Tool-Specific Instructions
Although we use GPG (and RSA) keys across each repository and package format, client-side tools might have specific instructions that differ (or require manual steps). To add or use the signing key for these tools, please click on the package format specific tabs above.
Public GPG Key
GPG-based keys/signatures are used by:
The public GPG key for the steven-adler/twocanplugin-beta is:
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2
mQENBF8qMSABCAC1WBN+cE4pZpZjEr0HQm8tNDcoKpvdMfpNEmfIv/CdmddUrV2K
FuZZPBgAk/qMBCIMlHgcpTzhpi8+L5peOnyXYE/iMhf0eIVPU+BwZZGnpviMD2Zp
SKfgeJX9YhGVcY1A1UUk09fatRSDfl8NnC+wI2bpB1Wdstr/Mi9R21xcF03s0DiQ
g46m5Rf7G5QXa8xwZQUfsKx5KRoE6LdvV4LyyzlWOn2mG9TDCXkR6xS9f1PT7M3n
jdRHaRVBWWV9ZLgMDPC+E9P2ttgyABdKv5UDLt0fWH556oXfnJsD91NEAuUGXm59
J5e7HKLCSdEiMR6bpK3haUqZ68wPFSVZfvkLABEBAAG0S0Nsb3Vkc21pdGggUGFj
a2FnZSAoc3RldmVuLWFkbGVyL3R3b2NhbnBsdWdpbi1iZXRhKSA8c3VwcG9ydEBj
bG91ZHNtaXRoLmlvPokBNwQTAQgAIQUCXyoxIAIbLwULCQgHAwUVCgkICwUWAgMB
AAIeAQIXgAAKCRCvxaqv7to5axAQB/0afjqyJyA1WycdkPj9QAERgHSAAk9/PJBc
RJXYbvDWd68E6eURv3Ni2plCWh1y24IA9vB6/BhyNSrZTpkxJWcKNvFEU5JFLdZf
At0JL1xxcoEl5/g1zRKCIjd/2VgKlnHSBHIEOW/LJDUSwwpfIhri+nxcHd5Qvsb+
gZbgd7duQRQQb9cUVjxacHX3SwEm3gpky3zNWfkNWg+8NMi+z9mu6AaE6XLcZKXS
K75rESURUkustumjMZqLFe7Idjgv9zDouuTHSqdZL5eGqHx1KlCg06Uhbs1uw0sa
cqZ5svozttXR58t0FEysJcDowDi3duLZNTv2HgZLaFLALbPjHjsJ
=cRDs
-----END PGP PUBLIC KEY BLOCK-----
It has the following long (20 bytes) and short (8 bytes) fingerprints:
9853C40C6D563F85891D7B39AFC5AAAFEEDA396B
AFC5AAAFEEDA396B
You can download the GPG key or fetch it via the command-line:
curl -1sLf 'https://dl.cloudsmith.io/public/steven-adler/twocanplugin-beta/gpg.AFC5AAAFEEDA396B.key'
Public RSA Key
RSA-based keys/signatures are used by:
The public RSA key for the steven-adler/twocanplugin-beta is:
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1/yF7xRIXxRGLJNpyLS0
0edjB0S3YpF/AzQ3FGFUKW8VbVOGDPjGLWoOicwg3pDynpbooCaPDAAVk4grNZDG
wGO4CaZHm6CQgFfq3eO4e02eLoqOvDLrxw2XSHVxLZgK9MvUG5uRaA5kzIeoR/Fg
GgJnLCjdPwJJVZDnMk9Y7t9aRmsh+NLpv6uifPm/387X3sbqyiW6aEQvWDqEUayz
TM+wEWzjrO3BC5Shi1X9u+u15uyi305dIHQu3MgQK5ZyYiGZ/MAwbeXhZmhuy3z9
KkuiNFbdwEfKlC6JBviaMjjGdwQMIPal2/jMl985TymFu1LnlRZvv1kFBfdPWatP
LQIDAQAB
-----END PUBLIC KEY-----
It has the following long (16 bytes) and short (8 bytes) fingerprints:
27DB60C2D20D6E7F07A69A8C8D2435FF
07A69A8C8D2435FF
You can download the RSA key or fetch it via the command-line:
curl -1sLf 'https://dl.cloudsmith.io/public/steven-adler/twocanplugin-beta/rsa.07A69A8C8D2435FF.key'
Public ECDSA Key
ECDSA-based keys/signatures are used by:
The public ECDSA OpenSSH key for the steven-adler/twocanplugin-beta is:
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEDtvlPVghpM+NINCARSsV5Wk+7z70
BSShILMcrfTcTGJDzQhw5EeOaR+AI8dPS4/tyVk+iqrPmyhzw2xIPiPWgQ==
-----END PUBLIC KEY-----
It has the following long (16 bytes) and short (8 bytes) fingerprints:
BDE24DA941E36ACC6A6232BE2E2207B2
6A6232BE2E2207B2
You can download the ECDSA key or fetch it via the command-line:
curl -1sLf 'https://dl.cloudsmith.io/public/steven-adler/twocanplugin-beta/ecdsa.6A6232BE2E2207B2.key'
Please note however that the NPM client does not require this key to be installed system-wide in order to allow for package verification - NPM tooling will handle keys automatically.
Need Help?
If you couldn't find what you needed in our documentation, then you can always chat to a member of our team instead. It's our mission to be your dedicated off-site team for package management, and we mean it. Come and chat with us, anytime.
What's this page? All Cloudsmith repositories and packages are signed using GPG, RSA or ECDSA keys where supported. Signatures and checksums provide reliable mechanisms to ensure that the packages that you download/install are neither corrupt nor modified. GPG is generally preferred, but RSA or ECDSA is used for some package formats (such as Alpine or NPM). Learn more in the signing keys documentation.