2.2 Remediated pin

Overview

You read a Lightwell OSV fixed event, then change the default Maven property on ConfigMap stub-04-remediated-pin to the exact .rhlw-* pin. Activating a profile that already contains the pin, without changing default, fails the Check. You do not commit to Gitea here. That is Track 3.

Why it matters

Scanners can stay red while you cannot jump to latest. Remediated artifacts are exact-version backports on the same upstream line, such as 3.14.0.rhlw-00001. You pin that certified baseline. Track 7 VEX binds to this GAV.

What does it solve

  • "Upgrade to latest" when you must stay on a certified version

  • Unused profiles that hide the pin

  • Inventing a qualifier

  • Bumping to a newer upstream line

OSV fixed → .rhlw-* pin

Premier members can pin from the private proxy before public OSV exists. This Check uses a public fixed event. There is no embargo artifact in this workshop.

Production Lightwell OSV ids look like RHLW-YYYY-NNNN. This workshop uses deterministic LW-DEMO-* records.

  • Worked example (not the Check): LW-DEMO-0001 / org.springframework:spring-core / 5.3.18.rhlw-00003

  • Scored: LW-DEMO-0002 / org.apache.commons:commons-lang3 / 3.14.0.rhlw-00001

Upstream 3.14.0 stays affected. The Lightwell pin is the fixed event. Track 7 VEX is bound to this GAV.

OSV fixed event mapped to a Maven default .rhlw pin

Discover the scored OSV (do not use the spring-core sample as the pin)

Userinfo keys for the Track 2 / Track 7 GAV
oc -n lightwell-repo get configmap demo-userinfo-lightwell-repo \
  -o jsonpath='id={.data.scored_vex_id}{"\n"}gav={.data.scored_vex_gav}{"\n"}base={.data.scored_vex_base_version}{"\n"}'
Scored OSV JSON — read affected[].ranges[].events[].fixed
oc -n lightwell-repo get configmap lightwell-repo-seed \
  -o jsonpath='{.data.LW-DEMO-0002\.json}'
Worked example OSV (different GAV — pasting its fixed into your pom still fails)
oc -n lightwell-repo get configmap lightwell-sample-osv \
  -o jsonpath='{.data.LW-DEMO-0001\.json}'

Reuse 2.1 settings and a writable local repo:

export MVN_LOCAL='-Dmaven.repo.local=/tmp/m2'
test -f ~/track-2-1-settings.xml && echo '2.1 settings present' || echo 'complete 2.1 first'

Worked example (not the Check)

Spring-core / LW-DEMO-0001. If the default property on stub-04-remediated-pin is this pin, the Check fails.

<!-- Worked example ONLY — different GAV. Do not use as the default commons.lang3.version. -->
<properties>
  <commons.lang3.version>5.3.18.rhlw-00003</commons.lang3.version>
</properties>

Your change: complete the pin ConfigMap

The scored object is ConfigMap stub-04-remediated-pin in lightwell-repo. Extract it to ~/track-2-2/pom.xml. The stub’s default property is the affected upstream line. Change only that default to the fixed version from LW-DEMO-0002, then write the ConfigMap back. Do not rely on a profile id that already embeds the pin.

Extract the incomplete seed
mkdir -p ~/track-2-2
oc -n lightwell-repo get configmap stub-04-remediated-pin \
  -o jsonpath='{.data.pom\.xml}' > ~/track-2-2/pom.xml

The seed looks like this (default 3.14.0 fails):

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>com.redhat.lightwell.workshop</groupId>
  <artifactId>track-2-2-pin</artifactId>
  <version>0.0.1</version>
  <properties>
    <!-- Stub: affected upstream. Your change: OSV fixed from LW-DEMO-0002. -->
    <commons.lang3.version>3.14.0</commons.lang3.version>
  </properties>
  <dependencies>
    <dependency>
      <groupId>org.apache.commons</groupId>
      <artifactId>commons-lang3</artifactId>
      <version>${commons.lang3.version}</version>
    </dependency>
  </dependencies>
</project>

Worked example pin (wrong GAV):

<!-- Worked example ONLY — spring-core, not the Check. -->
<commons.lang3.version>5.3.18.rhlw-00003</commons.lang3.version>
Write the pom back to the ConfigMap (after you replace 3.14.0 with the LW-DEMO-0002 fixed version)
oc -n lightwell-repo create configmap stub-04-remediated-pin \
  --from-file=pom.xml=$HOME/track-2-2/pom.xml \
  --dry-run=client -o yaml | oc apply -f -
grep commons.lang3.version ~/track-2-2/pom.xml

Check: dependency tree shows .rhlw-* from Nexus

Use the remediated profile from 2.1 settings so the GAV comes from Nexus, not Central.

mvn -s ~/track-2-1-settings.xml ${MVN_LOCAL} -f ~/track-2-2/pom.xml \
  -Plightwell-remediated dependency:tree

You should see org.apache.commons:commons-lang3:jar:3.14.0.rhlw-00001 and a download path on your Nexus host. A tree that still shows plain 3.14.0, 3.18.0, or 5.3.18.rhlw-00003, fails.

Fill the report

The Job also grades ConfigMap report-04-remediated-pin key pin_kind. Set it to exact-version. Empty or REPLACE_ME fails even if cluster state is correct. Do not copy validate-docs.

oc -n lw-poc-validate edit configmap report-04-remediated-pin

The scored Check is Job validate-04-remediated-pin in lw-poc-validate. Direct nav URLs still work (honor system). Unlimited retries. There is no Solve.

Run the Validate Job
oc -n lw-poc-validate delete job validate-04-remediated-pin --ignore-not-found
TPL='job-04.yaml'
oc -n lw-poc-validate get configmap validate-job-templates \
  -o go-template="{{ index .data \"${TPL}\" }}" | oc create -f -
oc -n lw-poc-validate logs -f job/validate-04-remediated-pin

Expect CHECK PASSED: before you continue. CHECK FAILED: names the object to fix. Delete the Job and create it again as often as you need.

Honor system: Track 3 still opens. The Validate Job grades the ConfigMap default property. The ~/track-2-2/pom.xml copy is for mvn -f.

Do not:

  • Commit to workshop-templates or GitHub

  • Treat a lightwell-remediated-pins profile as sufficient if default is still 3.14.0

  • Bump commons-lang3 to 3.18.0 (or any newer upstream). That is not Lightwell remediation.

  • Ingest VEX into TPA here (Track 7)

Callout: Python +rhlw.*

The same exact-version idea on PyPI is a PEP 440 local version on requirements.txt, for example lw-workshop-pypi==1.0.0+rhlw.00001.

Callout: Artifactory and .rhlw-*

The remediated GAV is the same coordinate on Artifactory. The remote must allow the .rhlw-* version suffix, and Maven still resolves it from your virtual, not from Central. This Check is the ConfigMap pom against Nexus Remediated.

Official documentation

Key takeaways

  • TSSC remediates with an exact pin, not latest. That is Lightwell Network Remediated.

  • This Check uses public OSV. Premier can pin from the private proxy before that public OSV exists.

  • Track 7 VEX is bound to this GAV after disclosure.

  • The scored pom lives in ConfigMap stub-04-remediated-pin until you commit it in Track 3.

cd ~/ocp5-rhacs-showroom
bash setup/lab-cleanup.sh --module tssc-04