# Cloudsmith glossary

## A

[Artifact provenance](/content/resources/glossary/artifact-provenance/index.html): Artifact provenance is verifiable information about where a software artifact came from and how it was built. It works like a chain of custody.…

[Audit trail](/content/resources/glossary/audit-trail/index.html): An Audit Trail is a chronological, tamper-resistant record of actions taken within a system, such as user logins, configuration changes, approvals, or data access…

## C

[Code signing](/content/resources/glossary/code-signing/index.html): Code Signing is the process of digitally signing software so users can verify two key facts:

[Compliance](/content/resources/glossary/compliance/index.html): Compliance refers to following the laws, regulations, standards, and internal policies that apply to an organization. These rules may relate to data protection, financial…

[Cooldown policy](/content/resources/glossary/cooldown-policy/index.html): A cooldown policy is a rule that holds newly published packages for a set period before they can be installed. It gives the community…

[Copyleft](/content/resources/glossary/copyleft/index.html): Copyleft is a licensing principle used in some open-source software that allows users to freely use, modify, and distribute code, as long as any…

[CVE (Common Vulnerabilities and Exposures)](/content/resources/glossary/cve/index.html): A CVE is a standard identifier assigned to a publicly disclosed security vulnerability in software or hardware. Each identifier follows the pattern CVE, year,…

## D

[Data privacy](/content/resources/glossary/data-privacy/index.html): Data Privacy refers to the responsible handling of personal and sensitive information, including how it is collected, stored, used, shared, protected, and eventually deleted.…

[Dependency confusion](/content/resources/glossary/dependency-confusion/index.html): Dependency confusion is an attack where a build installs a malicious public package instead of an internal package with the same name. It works…

[Dependency firewall](/content/resources/glossary/dependency-firewall/index.html): A dependency firewall is a control layer that decides which external packages may enter your environment before anyone can use them. It works like…

## G

[General public license](/content/resources/glossary/general-public-license/index.html): The General Public License (GPL) is one of the most widely known copyleft open-source licenses. Created by the Free Software Foundation, its purpose is…

[GPG key](/content/resources/glossary/gpg-key/index.html): A GPG Key (GNU Privacy Guard Key) is a cryptographic key pair used for encryption and digital signatures. It allows users and systems to…

## L

[License compliance](/content/resources/glossary/license-compliance/index.html): License Compliance is the practice of ensuring that all software within an organization is used in accordance with its licensing terms, whether the software…

[License management](/content/resources/glossary/license-management/index.html): License Management is the process of tracking, controlling, and optimizing software licenses across an organization. It ensures businesses remain compliant with license agreements while…

## M

[Malicious package detection](/content/resources/glossary/malicious-package-detection/index.html): Malicious package detection is the process of identifying software packages built to steal data, run hostile code, or compromise systems.

## O

[Open source license](/content/resources/glossary/open-source-license/index.html): An Open Source License is a legal agreement that defines how open-source software may be used, modified, and distributed. It protects both developers and…

## P

[Package signing](/content/resources/glossary/package-signing/index.html): Package Signing is the process of cryptographically signing software packages – such as libraries, installers, updates, or container images, so users can verify their…

[Policy as code](/content/resources/glossary/policy-as-code/index.html): Policy as code is the practice of writing security and compliance rules as versioned, machine-enforceable code. Instead of a document that people must remember,…

## S

[SBOM (Software Bill of Materials)](/content/resources/glossary/sbom/index.html): A Software Bill of Materials (SBOM) is a detailed inventory of every software component that comprises an application, including open-source libraries, third-party dependencies, frameworks,…

[Security scanning](/content/resources/glossary/security-scanning/index.html): Security Scanning is the process of automatically examining software, systems, code, and infrastructure to detect security vulnerabilities, misconfigurations, malware, and risky behavior before attackers…

[SIEM (Security Information and Event Management)](/content/resources/glossary/siem/index.html): Security Information and Event Management, or SIEM, helps solve cybersecurity problems by aggregating and analyzing log data from across an organization’s entire digital…

[Software license compliance](/content/resources/glossary/software-license-compliance/index.html): Software License Compliance is the practice of ensuring that all software inside an organization from SaaS subscriptions to open-source libraries, is being used strictly…

[Software supply chain attack](/content/resources/glossary/software-supply-chain-attack/index.html): A software supply chain attack is a cyberattack that targets an organization by compromising the third-party components, tools, or processes used to build and…

[Software supply chain security](/content/resources/glossary/software-supply-chain-security/index.html): Software Supply Chain Security is the practice of protecting every stage of the software lifecycle, from coding and dependency selection, through building, signing, distribution,…

## T

[Transitive dependency](/content/resources/glossary/transitive-dependency/index.html): A transitive dependency is a package your software needs indirectly because one of its direct dependencies requires it. If you add package A and…

[Trusted publishers](/content/resources/glossary/trusted-publishers/index.html): Trusted Publishers are verified organizations or developers who digitally sign and distribute software so users and systems can confirm the authenticity of the source.…

[Typosquatting](/content/resources/glossary/typosquatting/index.html): Typosquatting is publishing a malicious package with a name almost identical to a popular one, to catch mistyped or misremembered installs. A single swapped…

## U

[Upstream proxy](/content/resources/glossary/upstream-proxy/index.html): An upstream proxy is a registry that fetches packages from an external source on demand and serves them to your builds. Think of it…

## V

[Vulnerability management](/content/resources/glossary/vulnerability-management/index.html): Vulnerability Management is the ongoing process of finding, assessing, prioritizing, and fixing security weaknesses in software, systems, and infrastructure. Instead of reacting only when…

Qualified