Appendix: Acronym glossary

Use this glossary to look up terms while following the workshop. The last column connects each term to the object or evidence you inspect.

Acronym Expansion Workshop use

Acronym	Expansion	Workshop use
ACS	Advanced Cluster Security	Usually RHACS; image policy check, run directly against the promoted digest in 7.2
API	Application Programming Interface	HTTP endpoints (for example `/api/greeting`, RHTPA upload API)
ASL	Apache Software License	Workshop `commons-lang3` seed is an ASL 2.0 binary (2.1)
CI / CD	Continuous Integration / Continuous Delivery (or Deployment)	Pipelines and scanners that consume OSV / VEX
CVE	Common Vulnerabilities and Exposures	Public vulnerability identifiers. `LW-DEMO-0002` is a workshop advisory ID, not a real CVE.
CycloneDX	(name, not an acronym)	SBOM format used for Maven / `syft` in this workshop (4.4)
EOL	End of Life	Lifecycle conversations (for example obsolete JDK lines)
GAV	GroupId:ArtifactId:Version	Maven coordinate shape (2.1 resolution)
GitOps	Git Operations (desired state in Git)	Argo CD sync of workshop charts (6.1)
IdP	Identity Provider	Keycloak for RHTPA sign-in (7.1)
JAR	Java ARchive	Packaged Java library or application binary
JWKS	JSON Web Key Set	OIDC signing keys RHTPA loads from Keycloak
LWN	Lightwell Network	Validated / Remediated / Predisclosure repository tiers and console. Distinct from Lightwell Clearinghouse (workshop home)
OIDC	OpenID Connect	Browser / API login to TPA via Keycloak
OSV	Open Source Vulnerabilities	Machine-readable `fixed` events naming exact `.rhlw-*` versions (2.2)
PoC	Proof of Concept	Spring Boot PoC student application (`spring-boot-lw-poc`)
PoV	Proof of Value	Field delivery pattern this workshop mirrors
POM	Project Object Model	Maven `pom.xml` (version properties and profiles)
PVC	PersistentVolumeClaim	Cluster storage (for example Showroom terminal home)
RHACS	Red Hat Advanced Cluster Security	Image policy assessment in 7.2. Track 6 signature admission is a separate control.
RHDA	Red Hat Dependency Analytics	IDE shift-left client of TPA intelligence (RHDA appendix)
RHDH	Red Hat Developer Hub	Software Template used to create the application in Track 3 (`lightwell-java-service`)
RHDP	Red Hat Demo Platform	Catalog / Showroom hosting (Red Hat Demo Platform)
RHEL	Red Hat Enterprise Linux	OS / platform boundary complementary to Lightwell
RHTAS	Red Hat Trusted Artifact Signer	Keyless cosign (Fulcio / Rekor / TUF) in 5.1
RHTPA / TPA	Red Hat Trusted Profile Analyzer	SBOM and advisory system of record (7.1)
SBOM	Software Bill of Materials	Component inventory (CycloneDX via `syft` in 4.4)
SLSA	Supply-chain Levels for Software Artifacts	Build integrity story; this lab is not SLSA L3 (5.2)
SPDX	Software Package Data Exchange	SBOM format for Python wheels (narrative; Java labs use CycloneDX)
SSO	Single Sign-On	Workshop Keycloak realm `tpa` for RHTPA
TSSC	Trusted Software Supply Chain	Red Hat signing, SBOM, admission, and policy tooling plus trusted inputs (Hummingbird, Lightwell Network; Clearinghouse is a reference topic, not a second lab path)
TUF	The Update Framework	Trust root used with RHTAS keyless verification
UI	User Interface	Browser consoles (Showroom, Nexus, RHTPA, Argo CD)
VEX	Vulnerability Exploitability eXchange	Machine-readable remediation / exploitability status for scanners

ACS

Advanced Cluster Security

Usually RHACS; image policy check, run directly against the promoted digest in 7.2

API

Application Programming Interface

HTTP endpoints (for example /api/greeting, RHTPA upload API)

ASL

Apache Software License

Workshop commons-lang3 seed is an ASL 2.0 binary (2.1)

CI / CD

Continuous Integration / Continuous Delivery (or Deployment)

Pipelines and scanners that consume OSV / VEX

CVE

Common Vulnerabilities and Exposures

Public vulnerability identifiers. LW-DEMO-0002 is a workshop advisory ID, not a real CVE.

CycloneDX

(name, not an acronym)

SBOM format used for Maven / syft in this workshop (4.4)

EOL

End of Life

Lifecycle conversations (for example obsolete JDK lines)

GAV

GroupId:ArtifactId:Version

Maven coordinate shape (2.1 resolution)

GitOps

Git Operations (desired state in Git)

Argo CD sync of workshop charts (6.1)

IdP

Identity Provider

Keycloak for RHTPA sign-in (7.1)

JAR

Java ARchive

Packaged Java library or application binary

JWKS

JSON Web Key Set

OIDC signing keys RHTPA loads from Keycloak

LWN

Lightwell Network

Validated / Remediated / Predisclosure repository tiers and console. Distinct from Lightwell Clearinghouse (workshop home)

OIDC

OpenID Connect

Browser / API login to TPA via Keycloak

OSV

Open Source Vulnerabilities

Machine-readable fixed events naming exact .rhlw-* versions (2.2)

PoC

Proof of Concept

Spring Boot PoC student application (spring-boot-lw-poc)

PoV

Proof of Value

Field delivery pattern this workshop mirrors

POM

Project Object Model

Maven pom.xml (version properties and profiles)

PVC

PersistentVolumeClaim

Cluster storage (for example Showroom terminal home)

RHACS

Red Hat Advanced Cluster Security

Image policy assessment in 7.2. Track 6 signature admission is a separate control.

RHDA

Red Hat Dependency Analytics

IDE shift-left client of TPA intelligence (RHDA appendix)

RHDH

Red Hat Developer Hub

Software Template used to create the application in Track 3 (lightwell-java-service)

RHDP

Red Hat Demo Platform

Catalog / Showroom hosting (Red Hat Demo Platform)

RHEL

Red Hat Enterprise Linux

OS / platform boundary complementary to Lightwell

RHTAS

Red Hat Trusted Artifact Signer

Keyless cosign (Fulcio / Rekor / TUF) in 5.1

RHTPA / TPA

Red Hat Trusted Profile Analyzer

SBOM and advisory system of record (7.1)

SBOM

Software Bill of Materials

Component inventory (CycloneDX via syft in 4.4)

SLSA

Supply-chain Levels for Software Artifacts

Build integrity story; this lab is not SLSA L3 (5.2)

SPDX

Software Package Data Exchange

SBOM format for Python wheels (narrative; Java labs use CycloneDX)

SSO

Single Sign-On

Workshop Keycloak realm tpa for RHTPA

TSSC

Trusted Software Supply Chain

Red Hat signing, SBOM, admission, and policy tooling plus trusted inputs (Hummingbird, Lightwell Network; Clearinghouse is a reference topic, not a second lab path)

TUF

The Update Framework

Trust root used with RHTAS keyless verification

User Interface

Browser consoles (Showroom, Nexus, RHTPA, Argo CD)

VEX

Vulnerability Exploitability eXchange

Machine-readable remediation / exploitability status for scanners

Related: Lightwell concepts for product Q&A beyond acronym expansions.