2.2 Remediated pin

On this page you prove that the default Maven version of commons-lang3 is the exact Lightwell pin named by a Lightwell OSV fixed event.

Track 2 is the library input. This is the second page. 2.1 Enterprise proxy showed that Maven can see Lightwell through Nexus. A remediated artifact is a security backport on the upstream line you already run, with a version such as 3.14.0.rhlw-00001. You change the default property on ConfigMap stub-04-remediated-pin. Track 3 commits this pin to learner-owned git.

Why this control exists

A scanner can stay red on a library the application is not allowed to upgrade. Lightwell Network Remediated names the fix as an exact version in an OSV fixed event. You put that version on the default Maven property. A profile that already contains the pin, while the default stays on the affected line, fails the Check. Production builds use the default. An unused profile hides the affected GAV in the tree Track 7 will read.

The scored record is LW-DEMO-0002. Its fixed event is org.apache.commons:commons-lang3 at 3.14.0.rhlw-00001. Upstream 3.14.0 stays affected. Track 7 binds VEX to this GAV. If the default stays 3.14.0, the system of record still shows the CVE as open.

OSV fixed event mapped to a Maven default .rhlw pin

The figure is that mapping. The left box is the OSV event you read. The right box is the default property you write. The arrow is the exact version, 3.14.0.rhlw-00001.

Lightwell Clearinghouse Premier can remediate a member-specific version that is absent from the public Network catalog. The control is the same: pin the exact version from the enterprise proxy. This lab’s scored GAV is the Network sample, named by a public OSV fixed event. That public event is the post-disclosure end of the patch delivery lifecycle. An embargo is the window before that disclosure. Premier members may already have the .rhlw-* GAV in the private proxy while public OSV and VEX do not exist yet. You would still pin from the proxy. This cluster has no embargo artifact.

The Python form of this pin is a PEP 440 local version on requirements.txt, for example lw-workshop-pypi==1.0.0+rhlw.00001. This Check scores the Maven property.

In a customer engagement you pin the version the remediated GAV names. After disclosure, that name is the OSV fixed event. During a Premier embargo, the name is in the private proxy first. You do not invent a qualifier. Red Hat publishes the remediated GAV.

Learning objectives

By the end of this module, you will be able to:

  • Read a Lightwell OSV fixed event and map it to a .rhlw-* GAV

  • Change the default <commons.lang3.version> and show mvn dependency:tree resolving that GAV from Nexus Remediated

  • Explain that a Clearinghouse Premier member version, including one still under embargo, is pinned the same way

  • Name the Python +rhlw.* form of the same pin

The scored OSV event

Production Lightwell OSV ids look like RHLW-YYYY-NNNN. This workshop uses deterministic LW-DEMO-* records. Two of them are on the cluster. LW-DEMO-0001 is org.springframework:spring-core at 5.3.18.rhlw-00003. That record is the worked example. LW-DEMO-0002 is the scored pin.

Success of the userinfo read is the scored id, the GAV, and the affected base version.

Read the scored GAV
oc -n lightwell-repo get configmap demo-userinfo-lightwell-repo \
  -o jsonpath='id={.data.scored_vex_id}{"\n"}gav={.data.scored_vex_gav}{"\n"}base={.data.scored_vex_base_version}{"\n"}'

The pin itself is inside the OSV document, on affected[].ranges[].events[].fixed. Success is a JSON document whose fixed value is 3.14.0.rhlw-00001.

Read the scored OSV
oc -n lightwell-repo get configmap lightwell-repo-seed \
  -o jsonpath='{.data.LW-DEMO-0002\.json}'

ConfigMap lightwell-sample-osv holds LW-DEMO-0001. A default property set to 5.3.18.rhlw-00003 fails the Check, because that pin belongs to spring-core.

Read the worked-example OSV
oc -n lightwell-repo get configmap lightwell-sample-osv \
  -o jsonpath='{.data.LW-DEMO-0001\.json}'

The dependency tree uses the settings file from 2.1 and a local repository under /tmp. Success is the line 2.1 settings present.

export MVN_LOCAL='-Dmaven.repo.local=/tmp/m2'
test -f ~/track-2-1-settings.xml && echo '2.1 settings present' || echo 'complete 2.1 first'

The block below is the same property on the wrong GAV. A default of 5.3.18.rhlw-00003 fails the Check.

<!-- Worked example ONLY — different GAV. Do not use as the default commons.lang3.version. -->
<properties>
  <commons.lang3.version>5.3.18.rhlw-00003</commons.lang3.version>
</properties>

Your change

The scored object is ConfigMap stub-04-remediated-pin in namespace lightwell-repo, key pom.xml. Extract it to ~/track-2-2/pom.xml. The stub’s default property is the affected upstream line, 3.14.0. Change that default to the fixed version from LW-DEMO-0002, then write the ConfigMap back. A profile id that already embeds the pin leaves the default on 3.14.0, and that default fails the Check.

Success of the extract is a pom whose <commons.lang3.version> is still 3.14.0.

Extract the incomplete seed
mkdir -p ~/track-2-2
oc -n lightwell-repo get configmap stub-04-remediated-pin \
  -o jsonpath='{.data.pom\.xml}' > ~/track-2-2/pom.xml

The seed looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>com.redhat.lightwell.workshop</groupId>
  <artifactId>track-2-2-pin</artifactId>
  <version>0.0.1</version>
  <properties>
    <!-- Stub: affected upstream. Your change: OSV fixed from LW-DEMO-0002. -->
    <commons.lang3.version>3.14.0</commons.lang3.version>
  </properties>
  <dependencies>
    <dependency>
      <groupId>org.apache.commons</groupId>
      <artifactId>commons-lang3</artifactId>
      <version>${commons.lang3.version}</version>
    </dependency>
  </dependencies>
</project>

Writing the ConfigMap back succeeds when grep prints the remediated version on the default property.

Write the pom back to the ConfigMap
oc -n lightwell-repo create configmap stub-04-remediated-pin \
  --from-file=pom.xml=$HOME/track-2-2/pom.xml \
  --dry-run=client -o yaml | oc apply -f -
grep commons.lang3.version ~/track-2-2/pom.xml

Check

Resolve the tree with the remediated profile from the 2.1 settings, so the GAV comes from Nexus Remediated. Success is a line org.apache.commons:commons-lang3:jar:3.14.0.rhlw-00001 and a download path on your Nexus host. A tree that still shows 3.14.0, 3.18.0, or 5.3.18.rhlw-00003 fails the Check. 3.18.0 is a newer upstream line. It is a different fix from the Lightwell pin.

mvn -s ~/track-2-1-settings.xml ${MVN_LOCAL} -f ~/track-2-2/pom.xml \
  -Plightwell-remediated dependency:tree

The home-directory pom is what mvn -f reads. The Validate Job grades the default property on ConfigMap stub-04-remediated-pin. Track 3 still opens if you skip this page. The git commit of this pin happens there, on the learner remote. Committing to workshop-templates or to GitHub fails that later Check. Ingesting VEX is Track 7.

Fill the report

The Job also grades ConfigMap report-04-remediated-pin key pin_kind. Set it to exact-version. Empty or REPLACE_ME fails even if cluster state is correct. Do not copy validate-docs.

oc -n lw-poc-validate edit configmap report-04-remediated-pin

The scored Check is Job validate-04-remediated-pin in lw-poc-validate. Direct nav URLs still work (honor system). Unlimited retries. There is no Solve.

Run the Validate Job
oc -n lw-poc-validate delete job validate-04-remediated-pin --ignore-not-found
TPL='job-04.yaml'
oc -n lw-poc-validate get configmap validate-job-templates \
  -o go-template="{{ index .data \"${TPL}\" }}" | oc create -f -
oc -n lw-poc-validate logs -f job/validate-04-remediated-pin

Expect CHECK PASSED: before you continue. CHECK FAILED: names the object to fix. Delete the Job and create it again as often as you need.

On Artifactory the remediated GAV is the same coordinate. The remote has to allow the .rhlw-* suffix, and Maven still resolves it from the customer virtual. This Check is the ConfigMap pom against Nexus Remediated.

Official documentation

Key takeaways

  • The remediation is an exact pin. Lightwell Network Remediated is the name of that pin.

  • This Check uses public OSV. A Premier embargo is the same pin, taken from the private proxy before that OSV exists.

  • Track 7 VEX is bound to this GAV.

  • The scored pom stays in ConfigMap stub-04-remediated-pin until Track 3 owns the git remote.