OpenShift Dev Spaces
Cloud IDE with the Trusted Profile Analyzer client — VS Code extension redhat.fabric8-analytics
(RHDA) — plus a 3-command journey.
Red Hat Lightwell Network · Java demo
Secure legacy Java deps on OpenShift Dev Spaces
TL;DR: This sandbox demo shows how
Red Hat Lightwell Network
remediates vulnerable Java deps via Nexus on OpenShift — for architects and DevSecOps.
Expect ~15–20 minutes: open Dev Spaces, run three tasks, then compare image-scan
CVEs vs Lightwell
.rhlw coordinates
(RHDA
will not go "all green").
The subtle point: Artifact Hub may flag stock commons-io in the WildFly
image scan,
while the app itself builds with Lightwell .rhlw via Nexus — two different planes, both honest.
Primary action — run the demo in the cloud IDE:
Secure development journey
Lightwell remediates vulnerable Java deps;
RHDA/TPA
surfaces CVEs in the IDE;
Tekton builds through Nexus→Lightwell on OpenShift. Images land on
Quay (latest / contingency);
GHCR is the public fallback.
.rhlw artifacts.
commons-io.
redhat.fabric8-analytics
(RHDA /
TPA) + Java pack; then run analyze-cves.
analyze-cves for RHDA on pom.xml.
Downloaded from maven-lightwell-validated — commons-io:2.11.0.rhlw-00001.
.rhlw POMs/JARs resolved from Nexus (checksum warn is expected).
latest / contingency / sha-… to Quay. GHCR is the public fallback.
demo-lightwell 0.2.2, jboss-app 0.1.3, nexus, devspaces-workspace.
commons-io:2.11.0 CVE in WildFly layers. CVE proof →
.rhlw deps — not an all-green zero-CVE badge.
How to run RHDA →
commons-io.
server.log: Deployed "ROOT.war" and WildFly started.
Platform stack
Official Red Hat technology icons (console.redhat.com) used for product recognition.
OpenShift Pipelines
Tekton pipeline builds the WAR via Nexus→Lightwell and deploys the JBoss/WildFly app.
Product page →
Red Hat Quay
Primary release registry: GHA pushes latest / contingency to Quay (GHCR is the public fallback).
Architecture
DevSpaces / Tekton → Nexus → Lightwell registry; GHA → Quay (GHCR fallback) → JBoss console.
