Add SecureChain for Open Source documentation section

docs/.vuepress/client.ts

@@ -17,6 +17,7 @@ import CodeTabs from "./components/CodeTabs.vue";
 import TableTabs from "./components/TableTabs.vue";
 import ELSTechnology from "./components/ELSTechnology.vue";
 import ELSRTechnology from "./components/ELSRTechnology.vue";
+import SecureChainEcosystemSelector from "./components/SecureChainEcosystemSelector.vue";
 import ELSOSSelector from "./components/ELSOSSelector.vue";
 import ELSPrerequisites from "./components/ELSPrerequisites.vue";
 import ELSSteps from "./components/ELSSteps.vue";
@@ -55,6 +56,7 @@ export default defineClientConfig({
         app.component("TableTabs", TableTabs);
         app.component("ELSTechnology", ELSTechnology);
         app.component("ELSRTechnology", ELSRTechnology);
+        app.component("SecureChainEcosystemSelector", SecureChainEcosystemSelector);
         app.component("ELSOSSelector", ELSOSSelector);
         app.component("ELSPrerequisites", ELSPrerequisites);
         app.component("ELSSteps", ELSSteps);

docs/.vuepress/components/SecureChainEcosystemSelector.vue

@@ -0,0 +1,159 @@
+<template>
+  <div class="ecosystem-selector">
+    <div class="ecosystem-selector-heading">
+      <h3>Select your ecosystem to get started with SecureChain.</h3>
+    </div>
+
+    <div class="ecosystem-grid">
+      <a
+        v-for="(eco, index) in ecosystems"
+        :key="index"
+        :href="eco.link"
+        class="ecosystem-card"
+      >
+        <span class="ecosystem-card-icon">
+          <img :src="eco.icon" alt="" aria-hidden="true" />
+        </span>
+        <span class="ecosystem-card-name">{{ eco.name }}</span>
+        <span class="ecosystem-card-arrow">&rarr;</span>
+      </a>
+    </div>
+
+    <p class="ecosystem-selector-footer">
+      Python, Java, Go, and PHP are on the roadmap. Contact <a href="mailto:sales@tuxcare.com">sales@tuxcare.com</a> for status or to request early access.
+    </p>
+  </div>
+</template>
+
+<script setup>
+const ecosystems = [
+  {
+    name: "JavaScript",
+    icon: "/images/javascript.webp",
+    link: "./javascript/",
+  },
+];
+</script>
+
+<style scoped>
+.ecosystem-selector {
+  margin: 1rem 0;
+}
+
+.ecosystem-selector-heading {
+  text-align: center;
+  margin-bottom: 1.25rem;
+}
+
+.ecosystem-selector-heading h3 {
+  font-size: 1.3rem;
+  font-weight: 700;
+  margin-bottom: 0.25rem;
+}
+
+.ecosystem-selector-heading p {
+  color: #5c6370;
+  font-size: 0.95rem;
+  margin: 0;
+}
+
+.ecosystem-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(200px, 1fr));
+  gap: 0.75rem;
+}
+
+.ecosystem-card {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  padding: 0.85rem 1rem;
+  border-radius: 12px;
+  border: 1px solid #e0e3e8;
+  background: #fff;
+  text-decoration: none;
+  color: inherit;
+  transition: all 0.2s ease;
+  cursor: pointer;
+}
+
+.ecosystem-card:hover {
+  border-color: #F48243;
+  background: #FEF6F2;
+  transform: translateY(-2px);
+  box-shadow: 0 4px 12px rgba(244, 130, 67, 0.12);
+}
+
+.ecosystem-card:hover .ecosystem-card-arrow {
+  opacity: 1;
+  transform: translateX(0);
+  color: #F48243;
+}
+
+.ecosystem-card-icon {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 36px;
+  height: 36px;
+  flex-shrink: 0;
+}
+
+.ecosystem-card-icon img {
+  max-width: 100%;
+  max-height: 100%;
+  object-fit: contain;
+}
+
+.ecosystem-card-name {
+  flex: 1;
+  font-size: 0.9rem;
+  font-weight: 500;
+  color: #1b1f27;
+  line-height: 1.3;
+}
+
+.ecosystem-card-arrow {
+  font-size: 1.1rem;
+  opacity: 0;
+  transform: translateX(-4px);
+  transition: all 0.2s ease;
+  color: #5c6370;
+  flex-shrink: 0;
+  display: flex;
+  align-items: center;
+}
+
+.ecosystem-selector-footer {
+  text-align: center;
+  margin-top: 1.25rem;
+  margin-bottom: 0;
+  font-size: 0.9rem;
+  color: #5c6370;
+}
+
+.ecosystem-selector-footer a {
+  color: #0B5CAD;
+  text-decoration: none;
+}
+
+.ecosystem-selector-footer a:hover {
+  text-decoration: underline;
+}
+
+@media (max-width: 768px) {
+  .ecosystem-grid {
+    grid-template-columns: repeat(auto-fill, minmax(160px, 1fr));
+    gap: 0.5rem;
+  }
+
+  .ecosystem-card {
+    padding: 0.7rem 0.85rem;
+  }
+
+  .ecosystem-card-icon {
+    width: 28px;
+    height: 28px;
+  }
+}
+</style>

docs/.vuepress/config-client/documents.ts

@@ -54,6 +54,11 @@ export default [
         description: "provides security fixes for open-source applications after official support ends.",
         link: "/els-for-applications/",
     },
+    {
+        title: "SecureChain for Open Source",
+        description: "delivers verified, signed, continuously patched open-source packages from a trusted, TuxCare-managed registry — drop-in replacements that extend protection beyond upstream end of life. Available for JavaScript at launch, with Python, Java, Go, and PHP on the roadmap.",
+        link: "/securechain/",
+    },
     {
         title: "Subscription Management Portal",
         description: "The TuxCare subscription management portal is designed to easily manage your licenses of TuxCare products and services by means of a user-friendly interface.",

docs/.vuepress/config-client/sidebar.ts

@@ -495,6 +495,24 @@ export default {
             ]
         },
     ],
+    '/securechain/': [
+        {
+            collapsable: false,
+            children: [
+                "/securechain/",
+                {
+                    path: '/securechain/javascript/',
+                    icon: '/images/javascript.webp',
+                },
+                {
+                    title: 'Resources',
+                    type: 'section-header',
+                    icon: '/images/star.webp',
+                },
+                "/securechain/managing-securechain-repository/",
+            ]
+        },
+    ],
     '/els-for-applications/': [
         {
             collapsable: false,

docs/.vuepress/theme/components/Breadcrumb.vue

@@ -27,6 +27,7 @@ const titleMap = {
   '/els-for-os/': 'ELS for OS',
   '/els-for-runtimes/': 'ELS for Runtimes',
   '/enterprise-support-for-almalinux/': 'Enterprise Support for AlmaLinux',
+  '/securechain/': 'SecureChain for Open Source Software',
 };
 
 const breadCrumbs = computed(() => {

docs/securechain/README.md

@@ -0,0 +1,77 @@
+<!-- markdownlint-disable MD029 MD024 MD036 -->
+
+# SecureChain for Open Source Software
+
+<SecureChainEcosystemSelector />
+
+## What SecureChain Covers
+
+* Verified, signed builds from trusted sources
+* Coverage that continues after upstream end of life
+* A single registry your developers and CI already know how to talk to
+
+## Vulnerability Coverage and Target Response Times
+
+TuxCare employs the Common Vulnerability Scoring System (CVSS) to assess the severity of security vulnerabilities. Our severity rating system for patching vulnerabilities integrates both NVD scoring and vendor scoring (when available). When the vendor's score is lower than the NVD score, we prioritize the NVD score.
+
+Aligning with many industry standards and regulatory requirements, TuxCare is committed to delivering timely security updates. For instance, the Payment Card Industry Data Security Standard (PCI DSS) mandates that all 'High' vulnerabilities (CVSS score of 7.0+) must be addressed within 30 days. Other regulations and standards, such as the Health Insurance Portability and Accountability Act (HIPAA) for healthcare or the Federal Information Security Management Act (FISMA) for government agencies, uphold similar requirements.
+
+* **Vulnerability coverage.** TuxCare shall provide security patches for critical- and high-risk (CVSS 7.0 and above), medium-risk (CVSS 4.0 to 6.9), and low-risk (CVSS 0.1 to 3.9) vulnerabilities. TuxCare reserves the right to offer a mitigation strategy as an alternative to a direct code fix.
+
+* **Response time.** TuxCare will make commercially reasonable efforts to adhere to the following guidelines when addressing vulnerabilities:
+    * **High- and critical-risk vulnerabilities (CVSS 7.0 and above):** Patches are provided within 14 days from the date the vulnerabilities are publicly disclosed.
+    * **Medium-risk vulnerabilities (CVSS 4.0 to 6.9):** Patches are provided within 60 days from the date the vulnerabilities are publicly disclosed.
+    * **Low-risk vulnerabilities (CVSS 0.1 to 3.9):** Patches are provided within 90 days from the date the vulnerabilities are publicly disclosed.
+
+## Incident Reporting and Response Timeframe
+
+Customers can report vulnerabilities by submitting a ticket through the [TuxCare Support Portal](https://tuxcare.com/support-portal/). TuxCare commits to providing an initial response to any reported issue within 3 days.
+
+Requests for customer-directed security patches for CVEs that are outside of the SecureChain scope will be reviewed within 3 working days. If the request is accepted, we will provide the patch within the next 60 days.
+
+Handling Multiple Vulnerabilities: In cases where several CVEs are reported simultaneously for fixing, TuxCare will discuss and agree upon resolution timelines separately with the customer.
+
+## Enhanced Transparency & Visibility
+
+TuxCare's commitment to transparency and visibility is foundational to our SecureChain offering. We aim to provide comprehensive details about how each package is built, verified, and distributed, ensuring complete trust in the software supply chain.
+
+* **SLSA Compliance**: All packages are built and signed to ensure verifiable Supply-chain Levels for Software Artifacts (SLSA) compliance at Level 2 at launch, with Level 3 on the roadmap. They are securely constructed from vetted sources, include attestations for all dependencies, and undergo continuous testing to maintain integrity and security.
+* **Software Bill of Materials (SBOM)**: We provide complete visibility into the software supply chain with a comprehensive inventory of every package in the codebase, ensuring transparency and accountability in your software ecosystem.
+
+:::warning
+Note: SBOM support for certain components is in progress and will be available soon. To confirm current availability or expected timeframes, please contact [sales@tuxcare.com](mailto:sales@tuxcare.com).
+:::
+
+* **Enhanced metadata in standard formats.** SBOMs are provided in SPDX and CycloneDX. CycloneDX VEX documents accompany them with exploitability status (affected, not_affected, fixed, under_investigation) so scanners can suppress non-applicable findings.
+* **Verifiable Integrity and Provenance**: Our packages and metadata provide comprehensive end-to-end provenance, detailing how each package was constructed and tested, ensuring that all components in your software stack are trustworthy.
+* **Secure Distribution**: Signed versions of the packages and their metadata are distributed from a registry managed, secured, and protected by TuxCare, guaranteeing that your software updates are authentic and untampered.
+
+## Support Duration
+
+TuxCare provides continuous security patching for all SecureChain-supported open-source packages for as long as your organization requires them, eliminating the need for rushed or disruptive upgrades.
+
+All updates are delivered at a fixed price for the full term of your contract, ensuring predictable costs and uninterrupted protection.
+
+## Technical Support
+
+TuxCare provides technical support according to the standard [support policy](https://tuxcare.com/TuxCare-support-policy.pdf).
+
+It delivers 24/7/365 access to TuxCare's support team through the [TuxCare Support Portal](https://tuxcare.com/support-portal/) and to TuxCare's online knowledge base.
+
+## Vulnerability Exploitability eXchange (VEX)
+
+VEX is a machine-readable format that tells you if a known vulnerability is actually exploitable in your product. It reduces false positives, helps prioritize real risks.
+
+Why it matters:
+
+* Context-aware vulnerability status ("affected", "not affected", "fixed")
+* Cuts scanner noise to what truly matters
+* Automation-friendly for tooling and CI/CD
+
+<WhatsNext hide-title>
+
+* ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/) — Vulnerability Exploitability eXchange feed
+* ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/) — Track vulnerability fixes and updates
+
+</WhatsNext>
+

docs/securechain/javascript/README.md

@@ -0,0 +1,72 @@
+# JavaScript
+
+SecureChain delivers verified, signed, continuously patched JavaScript packages from a TuxCare-managed npm registry. Packages install with standard `npm` tooling and continue to receive CVE patches after upstream end of life.
+
+## Installation
+
+<ELSPrerequisites>
+
+* TuxCare SecureChain registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com)
+* An npm project with `package.json`. If you're starting from scratch, run `npm init -y` in your project directory to create one.
+* To browse available packages, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:securechain-js) and sign in. You may need to refresh the page after logging in.
+
+</ELSPrerequisites>
+
+<ELSSteps>
+
+1. Connect to the SecureChain registry
+
+   In the root directory of your project, create or edit `.npmrc` to point npm at the SecureChain registry and provide your token:
+
+   ```text
+   registry=https://nexus.repo.tuxcare.com/repository/securechain-js/
+   //nexus.repo.tuxcare.com/repository/securechain-js/:_auth=<TOKEN>
+   always-auth=true
+   ```
+
+   :::warning
+   Replace `<TOKEN>` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com).
+   :::
+
+2. Install a SecureChain package
+
+   SecureChain packages are published under the `@securechain-js` scope. Install them with their fully qualified name and version:
+
+   ```text
+   npm install @securechain-js/<package>@<version>
+   ```
+
+   For the list of available packages and versions, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:securechain-js).
+
+</ELSSteps>
+
+## Troubleshooting
+
+If `npm install` resolves to the public registry instead of SecureChain, use the commands below to verify that npm is reading your `.npmrc` and that the token is accepted.
+
+* **Confirm the active registry**
+
+   ```text
+   npm config get registry
+   ```
+
+   The output must be `https://nexus.repo.tuxcare.com/repository/securechain-js/`. If it returns `https://registry.npmjs.org/`, npm is not reading your project `.npmrc` - check that you are running npm from the project root and that no user-level `~/.npmrc` is overriding it.
+
+* **Confirm authentication and connectivity**
+
+   ```text
+   npm whoami
+   npm ping
+   ```
+
+   `npm whoami` confirms the token resolves to a Nexus user. `npm ping` confirms the registry is reachable with that token. Failures here usually mean a missing, malformed, or revoked `_auth` value in `.npmrc`.
+
+## What's Next?
+
+<WhatsNext hide-title>
+
+* ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/) — Vulnerability Exploitability eXchange feed
+* ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/) — Track vulnerability fixes and updates
+* ![](/images/wrench.webp) [Managing the SecureChain repository](/securechain/managing-securechain-repository/) — Upgrade to a newer version
+
+</WhatsNext>