Lightwell Network repositories

Lightwell Network provides signed, Supply Chain Levels for Software Artifacts (SLSA) Level 3-compliant repositories with verified build provenance. These repositories secure your open source dependencies using native formats for the ecosystem, with no application code modifications required.

With a Lightwell Network membership, you gain access to two repositories of signed artifacts: validated repository and remediated repository.

Validated repository

The validated repository provides securely rebuilt versions of the latest open source libraries to protect your software supply chain. Red Hat rebuilds these packages by using Red Hat Secure Software Pipelines.

• Integration requirements: Functions exactly like standard community libraries. You need to make only a one-time change to your repository URL, with no application code modifications required.
• When to use: Dependencies that require verified, reproducible builds but do not yet need security patches.
• Use cases:
  • Developing new features.
  • Adding new open source packages to your project.
  • Upgrading to the latest community versions.

Remediated repository

The remediated repository provides security fixes for the exact library versions you already use in production. This resolves critical vulnerabilities without the risk of a full system upgrade.

• Integration requirements: Requires no changes to your application code. You simply update your dependency configuration to point to the package version featuring the Lightwell Network suffix.
• When to use: Dependencies that need active CVE remediation without version upgrades.
• Use cases:
  • Maintaining live production applications.
  • Securing pinned dependencies without risking breaking updates.