chainguard-dev · mosabua · Jul 24, 2026 · Jul 16, 2026
@@ -3,7 +3,7 @@ title: "Learning Labs"
 description: "Education and training videos on demand"
 type: "article"
 date: 2025-06-18T21:00:00+00:00
-lastmod: 2026-06-02T21:00:00+00:00
+lastmod: 2026-07-23T20:03:45+00:00
 draft: false
 images: []
 tags: ["Learning Labs", "Overview"]
@@ -22,6 +22,7 @@ The lab notes often include demo projects, a slide presentation, sample
 commands, links to specific sections in the video, and pointers to more
 resources:
 
+- [{{<icon "play-circle-fill">}} Chainguard Libraries for Java with CVE remediation and fallback - July 2026](/software-security/learning-labs/ll202607/)
 - [{{<icon "play-circle-fill">}} Build Safely with AI - May 2026](/software-security/learning-labs/ll202605/)
 - [{{<icon "play-circle-fill">}} Securing CI/CD with Chainguard - April 2026](/software-security/learning-labs/ll202604/)
 - [{{<icon "play-circle-fill">}} Software supply chain attacks and Chainguard Libraries - March 2026](/software-security/learning-labs/ll202603/)

@@ -0,0 +1,146 @@
+---
+title: "Chainguard Libraries for Java"
+linktitle: "Chainguard Libraries for Java"
+description: "Learning lab for July 2026 on Chainguard Libraries for Java, covering CVE remediation, protected fallback to Maven Central, and cooldown policy."
+type: "article"
+date: 2026-07-24T12:00:00+00:00
+lastmod: 2026-07-24T18:43:51+00:00
+draft: false
+tags: ["Learning Labs", "Chainguard Libraries"]
+menu:
+  docs:
+    parent: "learning-labs"
+weight: 90
+toc: true
+---
+
+AI frontier models are accelerating the discovery of vulnerabilities in Java
+applications at a pace that teams can't keep up with. If your team is stuck on
+older Java versions that are hard to upgrade, you need support to remediate
+those vulnerabilities so you can get time back in your day to build.
+
+In the July 2026 Learning Lab, Manfred Moser shares the details behind
+Chainguard Libraries for Java, with an overview of how to start using
+remediated versions directly with Apache Maven.
+
+Manfred covers and demonstrates the following new features:
+
+- CVE remediation for Spring Framework and other libraries
+- Protected fallback to Maven Central
+- Cooldown and other policies
+
+The lab uses a hands-on demo project to migrate a typical Maven build to
+Chainguard Libraries.
+
+[Watch the recording](https://chainguard.registration.goldcast.io/webinar/61fa89da-1190-42bb-b7a4-712e925c64df)
+
+<!-- Add the recording after the event: {{< youtube VIDEO_ID >}} -->
+
+<!--
+## Sections
+
+Add timestamped sections after the recording is published:
+- [0:00](#) Introduction and agenda
+-->
+
+## Questions
+
+The following questions were asked by the audience during the event, and
+responses are added since time ran out to answer them all:
+
+### How does Chainguard differ from eg: "pip-audit" for Python? or npm run audit for Node? ..etc.
+
+`pip-audit` and `npm audit` are reactive scanners that flag known
+vulnerabilities in dependencies you already pulled from public registries.
+Chainguard Libraries is preventive: dependencies are rebuilt from source in the
+hardened Chainguard Factory and served with malware scanning and cooldown
+controls, closing off the build and distribution attack surface a scanner cannot
+see. The two are complementary. The VEX feed from Chainguard includes
+information about remediated CVEs on Chainguard Libraries and can be used by
+scanners.
+
+### For backported fixes for Java specifically, does Chainguard have an n-? support model as to which versions fixes will be backported to?
+
+There is no fixed n-minus matrix. Backports target critical and high CVEs on
+older versions that customers still run and that upstream no longer patches,
+prioritized by usage and demand. Request specific libraries through your account
+team. Typically n-? policies also are not meaningful since they are heavily
+impacted by the release cadence of upstream projects and the presence of
+multiple maintained major version streams. Chainguard focuses on the customer
+demand for backports.
+
+### When you say. "source" - is it the source Github repo? or the public registry (Eg: PyPI for python)
+
+Source means the upstream code in a source code manager such as GitHub or
+GitLab, not the binary from a registry like PyPI, npm, or Maven Central.
+Chainguard verifies the project's source URL and rebuilds from that code, so
+packages without a valid, verifiable source URL are out of scope and no binary
+is produced.
+
+### I don't see "Manage pull tokens" option under my Profile for Libraries
+
+Creating pull tokens requires the ecosystem entitlement and the matching
+`pull_token_creator` role, such as `libraries.java.pull_token_creator`. Without
+both, the option does not appear. Tokens live under **Overview** on the **Manage
+pull tokens** tab, not a personal profile menu. Ask an administrator to confirm
+your entitlement and role, or create tokens with `chainctl auth pull-token`.
+
+### Is there a way to update the policy, change cooldown period
+
+Yes. With the Owner role, and upstream fallback enabled, create a policy with a
+cooldown value and enforce it:
+
+```bash
+chainctl libraries policy create --name=java-trust --cooldown-days=0
+chainctl libraries policy enable java-trust --ecosystem=JAVA --mode=ENFORCE
+```
+
+The default is 7 days, and `--cooldown-days=0` deactivates cooldown. One custom
+policy per ecosystem carries all your cooldown, block, and override rules.
+
+### Any support for other tech - Golang, Rust
+
+Chainguard Libraries currently covers the Java, JavaScript, and Python
+ecosystems. Future plans are considering Golang, Rust, .NET, and others.
+
+### How do you deal with custom / non-standard / non-one-step builds? E.e. build that require (undocumented) properties set?
+
+In the context of Chainguard Libraries on the Chainguard side, we determine how
+to build libraries with the help of our expert engineers and our agentic
+infrastructure.
+
+In the context of customers using Chainguard Libraries on their own projects,
+you must troubleshoot and debug these details with the help of Apache Maven and
+other tools.
+
+### For the fix using this as an example do these fixes get pushed to the open source package instead of a private Chainguard repo? If not how come?
+
+Remediated fixes ship from the dedicated `java-remediated` Chainguard repository
+with a `-0.cgr.N` suffix, not upstream as the released artifact. These backports
+target older versions upstream no longer patches. Chainguard cannot publish them
+under the same coordinates on Maven Central. Chainguard does collaborate with
+upstream projects to contribute fixes as source code where possible and the
+project is interested.
+
+### If we are overriding versions how do we ensure integrity and stability of the application?
+
+Overriding dependency versions with CVE-remediated Java libraries allows you to
+keep the version difference of the change minimal and isolated to the CVE fixes.
+Nevertheless you must test your application thoroughly to ensure the integrity
+and stability of your application. When upgrading more libraries, and
+introducing larger version drifts, this need for verification and potentially
+adjusted code becomes more and more critical, and can result in significant
+necessary changes, that must be tested and verified like any other application
+change.
+
+### How do you ensure that the dependencies that you use during build do not contain any malicious code?
+
+When using Chainguard Libraries for Java with the fallback to upstream Maven
+Central, you can rely on the extensive analysis and scanning of the artifacts
+performed by Chainguard.
+
+## Resources
+
+- [Demo project on GitHub](https://github.com/chainguard-demo/chainguard-libraries-java)
+- [Slide deck](/downloads/learning-lab-202607.pdf)
+- [Chainguard Libraries documentation](/chainguard/libraries/overview/)