Choose the right repository for your environment
The Lightwell Network provides three repository tiers for each language ecosystem: Validated, Remediated, and Predisclosure. All of these tiers deliver artifacts in the native format for your ecosystem.
Most environments layer multiple tiers in a repository manager such as Artifactory or Nexus, with a virtual or group repository, ordered by precedence: typically, Predisclosure first, then Remediated, then Validated. This ensures that you always resolve the most current, most patched artifact. Lightwell provides the source tiers, and you build and control the combined view.
Choose the repository that matches your needs, and use the corresponding URL when configuring your build tool.
| Repository | Validated | Remediated | Predisclosure |
|---|---|---|---|
| Purpose |
Trust and verification of upstream code |
Delivery of backported security fixes |
Security fixes for novel vulnerabilities before public disclosure |
| Contents |
Upstream-parity artifacts, signed provenance record, and software bill of materials (SBOM) |
Lightwell-patched libraries with |
Content is rebuilt on top of the latest Remediated builds, and extends the versioning with an additional |
| Build standard |
SLSA Level 3 |
SLSA Level 3 |
SLSA Level 3 |
| When to use |
Dependencies that require verified, reproducible builds but do not yet need security patches |
Dependencies that need active CVE remediation without version upgrades |
Critical software dependencies where security is paramount and a proper testing pipeline validates application behavior |
| Java URL |
packages.redhat.com/lightwell/java/validated/ |
packages.redhat.com/lightwell/java/remediated/ |
packages.redhat.com/lightwell/java/predisclosure/ |
| Python URL |
packages.redhat.com/lightwell/python/validated/ |
packages.redhat.com/lightwell/python/remediated/ |
packages.redhat.com/lightwell/python/predisclosure/ |