Appendix: Lightwell concepts
Use this reference to understand how the library version selected in Track 2 fits into the wider supply chain. The workshop uses seeded examples and one Java application. Consult the linked product documentation for current catalog coverage, access, and service terms.
Separate the base image from the library
Hummingbird provides the application runtime base. Lightwell provides application dependency versions. Track 1 verifies the base image; Track 2 selects a Maven library version. Track 3 records both choices before the application is built.
Understand the three repository tiers
| Tier | Purpose and workshop scope | What you inspect |
|---|---|---|
Validated |
Establish an upstream-version baseline through the enterprise repository. |
Commons Lang |
Remediated |
Model a security-backport version on the existing release line using a seeded fixture; its upstream class files are unchanged. |
The OSV fixed event, POM property, and dependency tree for |
Predisclosure |
Network tier for fixes before public disclosure, subject to applicable access and distribution terms. Reference only; the lab exercises the other two tiers with seeded data. |
An additional |
A backport applies a fix to an earlier release line. The suffix identifies a distinct package version; it is part of the Maven coordinate you record in source. A repository channel alone does not tell you whether a particular finding is fixed. Compare the exact package and version with its advisory.
The sample LW-DEMO-0002 marks upstream 3.14.0 affected and the Lightwell version fixed. It is not a real CVE or an independent security assessment. See Select and verify the remediated dependency.
Place the enterprise repository in the path
Maven reads the learner’s settings.xml and obtains dependencies from Nexus. Provisioning may seed the repository or configure a proxy; the learner follows the URLs published in the claim. Artifactory can fill the enterprise repository role in a customer design, but this workshop uses Nexus.
Python expresses the equivalent exact-version choice in a requirements file with a +rhlw.* suffix. It remains a short comparison, not a second application exercise. Application testing is still required after selecting a remediated dependency.
Understand Network, Clearinghouse, and disclosure
As checked on 2026-11-10, Network has Validated, Remediated, and Predisclosure tiers. Clearinghouse is generally available to eligible organizations for approved scope and includes Network plus higher-touch customer-specific services. Neither offering implies universal package coverage. Confirm service entitlements and current terms with Red Hat. Predisclosure access is not exclusive to Clearinghouse. An embargo is the period in which vulnerability details or fixes have restricted distribution before public disclosure.
The delivery controls remain relevant in either case: obtain authorized artifacts, record the exact version, build and test the application, and retain its evidence. For restricted material, also define who may access the package and advisory and when they may be redistributed. This cluster does not exercise a live membership or embargo workflow. Confirm available services and access with Lightwell product information and the patch delivery lifecycle.
Read each evidence type for its purpose
| Evidence | Question it answers |
|---|---|
SBOM |
Which components were found in this artifact? Track 7 checks that the application SBOM describes the promoted digest. |
OSV |
Which package versions does this advisory identify as affected or fixed? Match the package before reading a fixed event. |
OpenVEX |
What status does the statement assign to the identified product? Module 7.2 inspects the sample locally and stores OSV in TPA. |
Image signature |
Does this signature verify for the digest and accepted identity or key? Track 5 verifies the assembled application. |
ACS policy response |
How did this image evaluate against the configured policies? Inspect the response and logs; importing a sample into TPA does not configure ACS. |
These artifacts support different conclusions. A signature does not establish that every component is safe, and a fixed library statement does not apply to the operating-system layer or every application in the organization.