Appendix: consultant delivery map

Scored

Gated Check. You clicked it.

Callout

One sentence on a scored page. No extra Check.

Mapping

Product name used in a client engagement → cluster object. Konflux terms: Konflux mapping (not this page).

Playbook

Procedure / talking points. Not executed on this connected RHDP claim.

Not on this claim

Cannot be honest on this topology. Not a workshop procedure.

Build minimal Fedora Hummingbird images

Playbook

Red Hat operates the factory. You consume published Hardened Images. 1.1

CVE-scan / FIPS-validate bases

Callout + scored VEX later

FIPS is a product claim, not a lab rebuild. Library VEX is 7.2

Strip packages / minimize surface

Playbook

Not a gated worksheet. Hummingbird is already minimal; you verify and pin it.

Attach SBOM + provenance (base)

Scored

1.1 published verify; 1.2 signatures + SBOM artifacts

Sign with Sigstore / cosign (base)

Scored

1.1 key-based published verify (Hardened Images key). App keyless is Track 5.

Continuous rebuild on upstream CVE

Playbook

Show digest freshness; do not run Red Hat’s rebuild factory.

Dual arch amd64 + arm64

Callout

One sentence on 1.1. Check is amd64. Hands-on dual-arch is not on this claim.

Publish to RH registry → customer Artifactory

Scored mirror + callout

1.2 into in-cluster dest. Customer dest is often Artifactory Docker — callout on 1.2. It is not installed on this claim.

Artifactory virtual repos → Lightwell only

Scored Nexus + callout

2.1 callout: Artifactory remote to Lightwell, virtual for Maven, include/exclude so only Lightwell paths resolve. No Artifactory on the claim.

Pull signed Hummingbird for app builds

Scored

3.2 runtime FROM dest digest

Hermetic Konflux / Hermeto

Scored + mapping

4.2 Task prefetch-dependencies. Not Konflux. Term map: Konflux mapping.

Conforma reject unapproved transitives

Scored

5.2

Cache / proxy for disconnected

Scored

2.1 Nexus; 4.1 forbid-list; 4.3 build egress

Renovate / MintMaker auto-update

Scored + mapping

3.3 live bot on Gitea. Client-engagement name “MintMaker” → this bot.

Validate SBOM + provenance before build

Scored (wire the Task)

Task verify-base-image in lightwell-tasks — not in the seed. You add it (same pattern as prefetch / Conforma).

Tekton Konflux pipelines

Mapping

OpenShift Pipelines under real names. Konflux mapping. Do not install Konflux.

Buildah rootless OCI builds

Mapping

4.4 OpenShift BuildConfig. No Buildah task.

Generate SBOM per build

Scored

4.4 syft-sbom-rhtpa; 7.1 TPA SoR

Sign with TAS (keyless)

Scored

5.1

SLSA L3 / Tekton Chains

Callout + Conforma

5.2 scores tightened Conforma; skip-att-sig-check stays true (ec 0.7 has no skip flag — ignore only the attestation builtin, do not use --ignore-rekor). Chains is mapping (Konflux mapping), not SLSA L3 on this claim.

Key-based / disconnected verify

Scored

5.3 second signature (sign --key / verify --key) on the 5.1 digest. Cluster stays networked. Media list: disconnected transfer.

Author Conforma policies

Scored

5.2

Hermetic verification

Scored

4.1 + 4.2 + 4.3

Promotion event to GitOps

Scored

6.2 second remote. Stage is 6.1.

bootc-image-builder → VM disk

Callout

Same signed digest, different runtime. One sentence on 6.1. No VM in the claim. Hands-on bootc is not this workshop.

oc-mirror v2 on a DMZ bastion

Scored (stand-in)

1.2 learner-run oc-mirror. Not a physical DMZ.

Mirror images + signatures + SBOM artifacts

Scored

1.2 ImageSet must include them; verify internal digest.

Mirror Lightwell Maven / pip indexes

Scored; pip note

2.1 settings.xml. pip.conf is one sentence on that page.

Physical media / data diode

Playbook

Cannot do air-gap physics on this connected claim. Simulated media drop (not the 5.3 Check).

Delta-sync via oc-mirror statefile

Thin / not a separate Check

Talk to 1.2 statefile; do not treat a full re-mirror as the only story.

Pre-download TUF root for disconnected cosign

Playbook

Simulated media drop copies TUF root.json + PEMs. Not the 5.3 Check (5.3 is --key).

cosign verify per image

Scored

1.1 published Hummingbird; 1.2 dest; 5.1 app keyless; 5.3 app key-based.

Verify SLSA + SBOM authenticity

Scored (policy) + callout

5.2 Conforma; 7.1 TPA. Full SLSA L3 / Chains: mapping only.

Verify Lightwell GPG / PEP 740

Playbook (stretch)

Not a gated Check. Java GPG / Python PEP 740 if the artifacts actually carry them.

Reject failures before build / unsigned at deploy

Scored

5.2 fail-then-pass; 6.1 unsigned deny (CRI-O ImagePolicy, not ClusterImagePolicy).

OpenShift GitOps / Argo CD

Scored

6.1 stage Application; 6.2 prod remote

Admission-time signature verification

Scored

6.1 portable TrustPolicy → namespaced ImagePolicy. Not RHACS for this gate.

Rolling / canary / blue-green

Scored rolling + callout

Rolling is what 6.1 deploys. Canary / blue-green: one sentence on 6.1.

KSPM / NetworkPolicy

Scored build + open operate

4.3 build-egress on lw-poc-build. app-operate on staging/prod stays open (not the 4.3 Check).

Continuous compliance post-deploy

Scored

7.1 promoted digest in TPA

TPA blast-radius / incident response

Scored

7.2 Lightwell GAV-bound VEX (LW-DEMO-0002)

ACS / StackRox runtime

Scored (pipeline)

7.2 acs-image-check not skipped. Not the 6.1 admission gate.

SIEM / SOAR

Not on this claim

No workshop procedure. Do not invent a SIEM on this topology.

Satellite + bootc upgrades

Callout

Same digest story on 6.1. Hands-on VM is not this workshop.