Lightwell Network repositories

Lightwell Network provides signed, Supply Chain Levels for Software Artifacts (SLSA) Level 3-compliant repositories with verified build provenance. These repositories secure your open source dependencies using native formats for the ecosystem.

With a Lightwell Network membership, you gain access to three repositories of signed artifacts per ecosystem: Validated repository, Remediated repository, and Predisclosure repository.

Validated repository

The Validated repository provides securely rebuilt versions of the latest open source libraries to protect your software supply chain. Red Hat rebuilds these packages by using Red Hat Secure Software Pipelines.

  • Integration requirements: Functions exactly like standard community libraries. You need to make only a one-time change to your repository URL, with no application code modifications required.
  • When to use: Dependencies that require verified, reproducible builds but do not yet need security patches.
  • Use cases:
    • Developing new features.
    • Adding new open source packages to your project.
    • Upgrading to the latest community versions.
Remediated repository

The Remediated repository provides community-approved security fixes for the exact library versions you already use in production. This resolves critical vulnerabilities without the risk of a full system upgrade.

  • Integration requirements:Update your dependency configuration to point to the package version featuring the Lightwell Network suffix.
  • When to use: Dependencies that need active CVE remediation without version upgrades.
  • Use cases:
    • Maintaining live production applications.
    • Securing pinned dependencies without risking breaking updates.
Predisclosure repository

The Predisclosure repository houses libraries that contain security fixes for novel vulnerabilities that are not publicly disclosed or have not been accepted by the upstream communities. As Red Hat discloses and addresses vulnerabilities upstream, the fixes are promoted from the Predisclosure repository to the Remediated repository. This provides you with the flexibility to choose between a proactive fix by using the Predisclosure repository, or an upstream vetted fix by using the Remediated repository.

Note:
The Predisclosure repository is not available as part of the Lightwell Network membership for R1 Institutions.
  • Integration requirements: Update your dependency configuration to point to the package version featuring the Lightwell Network suffix.
  • When to use: When you need the most recent security fixes, and are not concerned about acceptance by the upstream community.
  • Use cases:
    • Maintaining live production applications with robust CI/CD support.