Choose the right repository for your environment
The Lightwell Network provides two repository tiers for each language ecosystem: Validated and Remediated. Both tiers deliver artifacts in the native format for your ecosystem.
Choose the repository that matches your needs, and use the corresponding URL when configuring your build tool.
| Repository | Validated | Remediated |
|---|---|---|
| Purpose |
Trust and verification of upstream code |
Delivery of backported security fixes |
| Contents |
Upstream-parity artifacts, signed provenance record, and software bill of materials (SBOM) |
Lightwell-patched libraries with |
| Build standard |
SLSA Level 3 |
SLSA Level 3 |
| When to use |
Dependencies that require verified, reproducible builds but do not yet need security patches |
Dependencies that need active CVE remediation without version upgrades |
| Java URL |
packages.redhat.com/lightwell/java/validated/ |
packages.redhat.com/lightwell/java/remediated/ |
| Python URL |
packages.redhat.com/lightwell/python/validated/ |
packages.redhat.com/lightwell/python/remediated/ |