Skip to content

Commit 46288f7

Browse files
mosabuamosabua
committed
docs: add July 2026 learning lab for Java libraries
- Add recap page for the Chainguard Libraries for Java lab, covering CVE remediation, protected fallback to Maven Central, and cooldown policy, with scaffolding for the recording and section timestamps - Link the demo project and add the new lab to the Lab Notes index Assisted-by: Claude Opus 4.8 <noreply@anthropic.com>
1 parent c01f0cc commit 46288f7

3 files changed

Lines changed: 145 additions & 1 deletion

File tree

‎content/software-security/learning-labs/_index.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: "Learning Labs"
33
description: "Education and training videos on demand"
44
type: "article"
55
date: 2025-06-18T21:00:00+00:00
6-
lastmod: 2026-06-02T21:00:00+00:00
6+
lastmod: 2026-07-23T20:03:45+00:00
77
draft: false
88
images: []
99
tags: ["Learning Labs", "Overview"]
@@ -22,6 +22,7 @@ The lab notes often include demo projects, a slide presentation, sample
2222
commands, links to specific sections in the video, and pointers to more
2323
resources:
2424

25+
- [{{<icon "play-circle-fill">}} Chainguard Libraries for Java with CVE remediation and fallback - July 2026](/software-security/learning-labs/ll202607/)
2526
- [{{<icon "play-circle-fill">}} Build Safely with AI - May 2026](/software-security/learning-labs/ll202605/)
2627
- [{{<icon "play-circle-fill">}} Securing CI/CD with Chainguard - April 2026](/software-security/learning-labs/ll202604/)
2728
- [{{<icon "play-circle-fill">}} Software supply chain attacks and Chainguard Libraries - March 2026](/software-security/learning-labs/ll202603/)

‎content/software-security/learning-labs/ll202607.md‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
---
2+
title: "Chainguard Libraries for Java"
3+
linktitle: "Chainguard Libraries for Java"
4+
description: "Learning lab for July 2026 on Chainguard Libraries for Java, covering CVE remediation, protected fallback to Maven Central, and cooldown policy."
5+
type: "article"
6+
date: 2026-07-24T12:00:00+00:00
7+
lastmod: 2026-07-23T20:00:53+00:00
8+
draft: false
9+
tags: ["Learning Labs", "Chainguard Libraries"]
10+
menu:
11+
docs:
12+
parent: "learning-labs"
13+
weight: 90
14+
toc: true
15+
---
16+
17+
AI frontier models are accelerating the discovery of vulnerabilities in Java
18+
applications at a pace that teams can't keep up with. If your team is stuck on
19+
older Java versions that are hard to upgrade, you need support to remediate
20+
those vulnerabilities so you can get time back in your day to build.
21+
22+
In the July 2026 Learning Lab, Manfred Moser shares the details behind
23+
Chainguard Libraries for Java, with an overview of how to start using
24+
remediated versions directly with Apache Maven.
25+
26+
Manfred covers and demonstrates the following new features:
27+
28+
- CVE remediation for Spring Framework and other libraries
29+
- Protected fallback to Maven Central
30+
- Cooldown and other policies
31+
32+
The lab uses a hands-on demo project to migrate a typical Maven build to
33+
Chainguard Libraries.
34+
35+
<!-- Add the recording after the event: {{< youtube VIDEO_ID >}} -->
36+
37+
## Sections
38+
39+
<!-- Add timestamped sections after the recording is published:
40+
- [0:00](#) Introduction and agenda
41+
-->
42+
43+
## Questions
44+
45+
The following questions were asked by the audience during the event, and answers
46+
are added:
47+
48+
### How does Chainguard differ from eg: "pip-audit" for Python? or npm run audit for Node? ..etc.
49+
50+
`pip-audit` and `npm audit` are reactive scanners that flag known
51+
vulnerabilities in dependencies you already pulled from public registries.
52+
Chainguard Libraries is preventive: dependencies are rebuilt from source in the
53+
hardened Chainguard Factory and served with malware scanning and cooldown
54+
controls, closing off the build and distribution attack surface a scanner cannot
55+
see. The two are complementary. The VEX feed from Chainguard includes
56+
information about remediated CVEs on Chainguard Libraries and can be used by
57+
scanners.
58+
59+
### For backported fixes for Java specifically, does Chainguard have an n-? support model as to which versions fixes will be backported to?
60+
61+
There is no fixed n-minus matrix. Backports target critical and high CVEs on
62+
older versions that customers still run and that upstream no longer patches,
63+
prioritized by usage and demand. Request specific libraries through your account
64+
team. Typically n-? policies also are not meaningful since they are heavily
65+
impacted by the release cadence of upstream projects and the presence of
66+
multiple maintained major version streams. Chainguard focuses on the customer
67+
demand for backports.
68+
69+
### When you say. "source" - is it the source Github repo? or the public registry (Eg: PyPI for python)
70+
71+
Source means the upstream code in a source code manager such as GitHub or
72+
GitLab, not the binary from a registry like PyPI, npm, or Maven Central.
73+
Chainguard verifies the project's source URL and rebuilds from that code, so
74+
packages without a valid, verifiable source URL are out of scope and no binary
75+
is produced.
76+
77+
### I don't see "Manage pull tokens" option under my Profile for Libraries
78+
79+
Creating pull tokens requires the ecosystem entitlement and the matching
80+
`pull_token_creator` role, such as `libraries.java.pull_token_creator`. Without
81+
both, the option does not appear. Tokens live under **Overview** on the **Manage
82+
pull tokens** tab, not a personal profile menu. Ask an administrator to confirm
83+
your entitlement and role, or create tokens with `chainctl auth pull-token`.
84+
85+
### Is there a way to update the policy, change cooldown period
86+
87+
Yes. With the Owner role, and upstream fallback enabled, create a policy with a
88+
cooldown value and enforce it:
89+
90+
```bash
91+
chainctl libraries policy create --name=java-trust --cooldown-days=0
92+
chainctl libraries policy enable java-trust --ecosystem=JAVA --mode=ENFORCE
93+
```
94+
95+
The default is 7 days, and `--cooldown-days=0` deactivates cooldown. One custom
96+
policy per ecosystem carries all your cooldown, block, and override rules.
97+
98+
### Any support for other tech - Golang, Rust
99+
100+
Chainguard Libraries currently covers the Java, JavaScript, and Python
101+
ecosystems. Future plans are considering Golang, Rust, .NET, and others.
102+
103+
### How do you deal with custom / non-standard / non-one-step builds? E.e. build that require (undocumented) properties set?
104+
105+
In the context of Chainguard Libraries on the Chainguard side, we determine how
106+
to build libraries with the help of our expert engineers and our agentic
107+
infrastructure.
108+
109+
In the context of customers using Chainguard Libraries on their own projects,
110+
you must troubleshoot and debug these details with the help of Apache Maven and
111+
other tools.
112+
113+
### For the fix using this as an example do these fixes get pushed to the open source package instead of a private Chainguard repo? If not how come?
114+
115+
Remediated fixes ship from the dedicated `java-remediated` Chainguard repository
116+
with a `-0.cgr.N` suffix, not upstream as the released artifact. These backports
117+
target older versions upstream no longer patches. Chainguard cannot publish them
118+
under the same coordinates on Maven Central. Chainguard does collaborate with
119+
upstream projects to contribute fixes as source code where possible and the
120+
project is interested.
121+
122+
### If we are overriding versions how do we ensure integrity and stability of the application?
123+
124+
Overriding dependency versions with CVE-remediated Java libraries allows you to
125+
keep the version difference of the change minimal and isolated to the CVE fixes.
126+
Nevertheless you must test your application thoroughly to ensure the integrity
127+
and stability of your application. When upgrading more libraries, and
128+
introducing larger version drifts, this need for verification and potentially
129+
adjusted code becomes more and more critical, and can result in significant
130+
necessary changes, that must be tested and verified like any other application
131+
change.
132+
133+
### How do you ensure that the dependencies that you use during build do not contain any malicious code?
134+
135+
When using Chainguard Libraries for Java with the fallback to upstream Maven
136+
Central, you can rely on the extensive analysis and scanning of the artifacts
137+
performed by Chainguard.
138+
139+
## Resources
140+
141+
- [Demo project on GitHub](https://github.com/chainguard-demo/chainguard-libraries-java)
142+
- [Slide deck](/downloads/learning-lab-202607.pdf)
143+
- [Chainguard Libraries documentation](/chainguard/libraries/overview/)

‎static/downloads/learning-lab-202607.pdf‎

3.44 MB
Binary file not shown.

0 commit comments

Comments
 (0)