Red Hat

Proof & Charts

CVE evidence across three scanning planes, Helm chart catalog, and the path from demo to production subscription.

Proof: image scan vs Maven Lightwell vs RHDA

Three different signals — do not expect RHDA to go "all green" just because the pom uses .rhlw from the validated demo tier.

1) Artifact Hub (image)

  • Scans chart image quay.io/wildfly/wildfly:27.0.1…
  • Stock commons-io:2.11.0 in layers → CVE-2024-47554
  • Does not list the app's 2.11.0.rhlw-00001 GAV
  • Open Security Report

2) App build (Lightwell)

  • app/pom.xml → Nexus → Lightwell validated demo
  • Coordinates: …rhlw-00001 (not Maven Central stock)
  • Runtime health: commons-io: 2.11.0.rhlw-00001
  • "Validated" = trusted Lightwell path for the demo — not "OSV says 0 CVEs"
Tool What it looks at What you should see
Artifact Hub Chart artifacthub.io/images (WildFly) CVEs on stock jars in the image (e.g. commons-io 2.11.0)
Nexus / health endpoint Resolved Maven artifacts 2.11.0.rhlw-00001 from Lightwell proxy
RHDA / TPA plugin (IDE) Extension redhat.fabric8-analytics on pom.xml + OSV / remediations Still may show Direct Vulnerabilities on .rhlw rows and "Red Hat Dependency Remediations available" (the green check)

Screenshot of the Artifact Hub stock commons-io CVE lives in the journey carousel (avoids duplicating the same image here).

View journey slide → Open Security Report →

Why it is not all green

RHDA queries vulnerability databases (here rhtpa/osv-github). Those databases often still associate CVEs with the upstream lineage even when you consume a Lightwell .rhlw rebuild from the public validated demo catalog. What Lightwell + RHDA add in this demo is: you are on Red Hat coordinates, and the report surfaces remediation availability (see RHDA report). Clearing every OSV finding is the product path (subscription remediated tier + newer .rhlw-* builds), not a promise of the sandbox demo alone. For deeper remediations with a subscription, see Day-2: remediated tier.

Helm charts (Artifact Hub)

Each chart ships a README.md so Artifact Hub can render a full description. Repo index: charts/ · search on Artifact Hub.

demo-lightwell

Umbrella: secrets, Nexus, JBoss, Tekton PipelineRun, optional DevWorkspace — one helm upgrade --install.

Artifact Hub →

jboss-app

WildFly WAR + app Route + HAL console Route. Image scan on Artifact Hub uses the public WildFly base.

Artifact Hub →

nexus

Thin Nexus + PVC; configure Job wires Lightwell proxy with SA on the remote into maven-public.

Artifact Hub →

Also published: devspaces-workspace (DevWorkspace CR for GitOps-style IDE provisioning).

Day-2: validated demo → remediated (subscription)

This sandbox defaults to the public validated Lightwell demo index. With an active Lightwell Network membership, switch Nexus + Maven to the remediated tier (org service account, product URL, layout Strict) and re-run RHDA + rebuild.

Demo (default)Subscription
Tier Validated (public pulp demo) Remediated
URL …/public-lightwell-demo/java/validated/ https://packages.redhat.com/lightwell/java/remediated/
Expect in RHDA OSV findings + remediations available Newer .rhlw-* builds; fewer open findings as coverage grows

Beyond the demo

SLSA + SBOM (production)

This demo focuses on Lightwell remediations and CVE visibility. Generating an SBOM and attaching SLSA build provenance (attestations, policy gates) is out of scope here, but should be planned for a production secure supply-chain.