Cloudsmith glossary

A

Artifact provenance: Artifact provenance is verifiable information about where a software artifact came from and how it was built. It works like a chain of custody.…

Audit trail: An Audit Trail is a chronological, tamper-resistant record of actions taken within a system, such as user logins, configuration changes, approvals, or data access…

C

Code signing: Code Signing is the process of digitally signing software so users can verify two key facts:

Compliance: Compliance refers to following the laws, regulations, standards, and internal policies that apply to an organization. These rules may relate to data protection, financial…

Cooldown policy: A cooldown policy is a rule that holds newly published packages for a set period before they can be installed. It gives the community…

Copyleft: Copyleft is a licensing principle used in some open-source software that allows users to freely use, modify, and distribute code, as long as any…

CVE (Common Vulnerabilities and Exposures): A CVE is a standard identifier assigned to a publicly disclosed security vulnerability in software or hardware. Each identifier follows the pattern CVE, year,…

D

Data privacy: Data Privacy refers to the responsible handling of personal and sensitive information, including how it is collected, stored, used, shared, protected, and eventually deleted.…

Dependency confusion: Dependency confusion is an attack where a build installs a malicious public package instead of an internal package with the same name. It works…

Dependency firewall: A dependency firewall is a control layer that decides which external packages may enter your environment before anyone can use them. It works like…

G

General public license: The General Public License (GPL) is one of the most widely known copyleft open-source licenses. Created by the Free Software Foundation, its purpose is…

GPG key: A GPG Key (GNU Privacy Guard Key) is a cryptographic key pair used for encryption and digital signatures. It allows users and systems to…

L

License compliance: License Compliance is the practice of ensuring that all software within an organization is used in accordance with its licensing terms, whether the software…

License management: License Management is the process of tracking, controlling, and optimizing software licenses across an organization. It ensures businesses remain compliant with license agreements while…

M

Malicious package detection: Malicious package detection is the process of identifying software packages built to steal data, run hostile code, or compromise systems.

O

Open source license: An Open Source License is a legal agreement that defines how open-source software may be used, modified, and distributed. It protects both developers and…

P

Package signing: Package Signing is the process of cryptographically signing software packages – such as libraries, installers, updates, or container images, so users can verify their…

Policy as code: Policy as code is the practice of writing security and compliance rules as versioned, machine-enforceable code. Instead of a document that people must remember,…

S

SBOM (Software Bill of Materials): A Software Bill of Materials (SBOM) is a detailed inventory of every software component that comprises an application, including open-source libraries, third-party dependencies, frameworks,…

Security scanning: Security Scanning is the process of automatically examining software, systems, code, and infrastructure to detect security vulnerabilities, misconfigurations, malware, and risky behavior before attackers…

SIEM (Security Information and Event Management): Security Information and Event Management, or SIEM, helps solve cybersecurity problems by aggregating and analyzing log data from across an organization’s entire digital…

Software license compliance: Software License Compliance is the practice of ensuring that all software inside an organization from SaaS subscriptions to open-source libraries, is being used strictly…

Software supply chain attack: A software supply chain attack is a cyberattack that targets an organization by compromising the third-party components, tools, or processes used to build and…

Software supply chain security: Software Supply Chain Security is the practice of protecting every stage of the software lifecycle, from coding and dependency selection, through building, signing, distribution,…

T

Transitive dependency: A transitive dependency is a package your software needs indirectly because one of its direct dependencies requires it. If you add package A and…

Trusted publishers: Trusted Publishers are verified organizations or developers who digitally sign and distribute software so users and systems can confirm the authenticity of the source.…

Typosquatting: Typosquatting is publishing a malicious package with a name almost identical to a popular one, to catch mistyped or misremembered installs. A single swapped…

U

Upstream proxy: An upstream proxy is a registry that fetches packages from an external source on demand and serves them to your builds. Think of it…

V

Vulnerability management: Vulnerability Management is the ongoing process of finding, assessing, prioritizing, and fixing security weaknesses in software, systems, and infrastructure. Instead of reacting only when…

Qualified