Private Package Sharing

Now that you have created a private repository and uploaded your package: What happens when you want to share that file with someone else?

Cloudsmith Package has an in-built entitlement system allowing you full control over your private repositories. It allows you to share files with third-parties through a token based system (don't panic - we generate all the tokens for you!) and gives you the power to revoke a token at any time without disruption to your repository/package. Cool eh?

It's very simple. Say you want to give one of your customers - let's call him Arnold - a file that you have in one of your private repositories. To do this you can create Arnold a token called say "arnolds-token" and assign it to that file. Cloudsmith will prompt you with the URL embedded with the new super secret token allowing only those with the URL to access the file (you and Arnold).

1. Create an Entitlement Token

In a repository; click the "Settings" tab then click "Entitlement Tokens". This will take you to the Entitlements management page where you will see the Entitlement Tokens for the repository. If you have not previously created any Entitlement Tokens, you will only see the Default token for the repository. This is created for you as standard and will always be there (you can refresh it but not delete it).

Click the blue "Create New Token" button (top-right):

A form will be displayed asking for a name for the token - the name is inconsequential but a good name will help you track it later. Type in "arnolds-token" and click the "Create Token" button.

You will now see the new token:

2. Assign Entitlement Token to a Package

Navigate back to the private repository packages list page, and click on a package to review its details.

You will notice that there is a Use Package button on the right hand side. Click on it and a few options will be presented to configure or use the package with native tooling like, in the case of this example, pip. If you just want to send the url; right-click with the token of choice. In this case, select `arnold-token from the dropdown in Pull with a single command. Then, copy the link in the code-block and browse the index to find the package you want to share. Once you have it, use the browser's "Copy Link Address" feature to copy the url to your clipboard and share it.

3. Revoke Entitlement Token

If you decide you no longer want Arnold to have access to the file you can simply revoke his token. Go to the Entitlement management page - you can either delete the token entirely, disable the token, or Refresh the token - which will regenerate a new token code but still assigned to that name. Anyone with the previous code will no longer have access.