From b56653a811a46964fca3bda67ebe0409576348e7 Mon Sep 17 00:00:00 2001 From: s-stumbo Date: Fri, 9 Oct 2026 13:17:40 -0400 Subject: [PATCH 1/3] Add reusable Athena zero-day protection module to Libraries overviews Create a `blurb/athena.html` shortcode describing zero-day protection through the Athena coalition, and add it to the general Chainguard Libraries overview and the Java, JavaScript, and Python overview pages. The shortcode is invoked with the percent form so the heading renders as a real h2 and appears in each page's table of contents. Co-Authored-By: Claude Opus 4.8 (1M context) --- content/chainguard/libraries/introduction/overview.md | 4 +++- content/chainguard/libraries/java/overview.md | 4 +++- content/chainguard/libraries/javascript/overview.md | 4 +++- content/chainguard/libraries/python/overview.md | 4 +++- layouts/shortcodes/blurb/athena.html | 5 +++++ 5 files changed, 17 insertions(+), 4 deletions(-) create mode 100644 layouts/shortcodes/blurb/athena.html diff --git a/content/chainguard/libraries/introduction/overview.md b/content/chainguard/libraries/introduction/overview.md index 0242643c68..f24785455b 100644 --- a/content/chainguard/libraries/introduction/overview.md +++ b/content/chainguard/libraries/introduction/overview.md @@ -6,7 +6,7 @@ description: "Learn about Chainguard Libraries, providing enhanced security for comprehensive supply chain protection." type: "article" date: 2025-03-25T08:04:00+00:00 -lastmod: 2026-09-28T14:00:04+00:00 +lastmod: 2026-10-09T17:17:40+00:00 draft: false tags: ["Chainguard Libraries", "Overview"] menu: @@ -31,6 +31,8 @@ social engineering campaigns and malware injections to exfiltrate enterprise secrets. Chainguard Libraries prevents malware instead of making developers pause work, triage incidents, and respond after compromise. +{{% blurb/athena %}} + ## Background Open source libraries distributed through public repositories face several diff --git a/content/chainguard/libraries/java/overview.md b/content/chainguard/libraries/java/overview.md index a1d71ad4d0..0f834b9507 100644 --- a/content/chainguard/libraries/java/overview.md +++ b/content/chainguard/libraries/java/overview.md @@ -4,7 +4,7 @@ linktitle: "Java overview" description: "Learn about Chainguard Libraries for Java, providing enhanced security for Maven dependencies through automated vulnerability patching and supply chain protection" type: "article" date: 2025-03-25T08:04:00+00:00 -lastmod: 2026-10-07T18:02:47+00:00 +lastmod: 2026-10-09T17:17:40+00:00 draft: false tags: ["Chainguard Libraries", "Java", "Overview"] menu: @@ -47,6 +47,8 @@ continues to grow, and any request for a missing library or version automatically triggers a process to provision the artifacts from relevant sources if available. +{{% blurb/athena %}} + ## Runtime requirements The runtime requirements for Java artifacts available from Chainguard Libraries diff --git a/content/chainguard/libraries/javascript/overview.md b/content/chainguard/libraries/javascript/overview.md index 419133c9cf..ea2dae8814 100644 --- a/content/chainguard/libraries/javascript/overview.md +++ b/content/chainguard/libraries/javascript/overview.md @@ -6,7 +6,7 @@ aliases: description: "JavaScript libraries for your application development" type: "article" date: 2025-06-05T09:00:00+00:00 -lastmod: 2026-09-28T18:48:06+00:00 +lastmod: 2026-10-09T17:17:40+00:00 draft: false tags: ["Chainguard Libraries", "JavaScript", "Overview"] menu: @@ -34,6 +34,8 @@ Repository](/chainguard/libraries/javascript/overview/), which provides a single endpoint for package retrieval and supports configurable security policies for both Chainguard-built and upstream packages. +{{% blurb/athena %}} + ## Background The main public repository for JavaScript packages is the [npm diff --git a/content/chainguard/libraries/python/overview.md b/content/chainguard/libraries/python/overview.md index 8c022ee168..6bef1ceb3e 100644 --- a/content/chainguard/libraries/python/overview.md +++ b/content/chainguard/libraries/python/overview.md @@ -4,7 +4,7 @@ linktitle: "Python overview" description: "Learn about Chainguard Libraries for Python, providing enhanced security for PyPI packages through automated vulnerability patching and supply chain protection" type: "article" date: 2025-04-09T04:00:00+00:00 -lastmod: 2026-09-28T14:00:04+00:00 +lastmod: 2026-10-09T17:17:40+00:00 draft: false tags: ["Chainguard Libraries", "Python", "Overview"] menu: @@ -33,6 +33,8 @@ sources if available. In combination with third-party software repository managers, you can use Chainguard Libraries for Python as a secure source of truth for your development process. +{{% blurb/athena %}} + ## Technical details Most organizations consume Chainguard Libraries for Python through a repository diff --git a/layouts/shortcodes/blurb/athena.html b/layouts/shortcodes/blurb/athena.html new file mode 100644 index 0000000000..c491ad12bc --- /dev/null +++ b/layouts/shortcodes/blurb/athena.html @@ -0,0 +1,5 @@ +## Zero-day protection, powered by Athena + +Frontier AI models are uncovering vulnerabilities in open source software before traditional security tools can detect them. Chainguard Libraries helps reduce that exposure by delivering remediated artifacts through the [Athena](https://www.chainguard.dev/athena) coalition. + +Chainguard validates, patches, rebuilds, and tests affected packages, then makes the fixed artifacts available through Chainguard Libraries. Customers can continue using supported package versions while receiving verifiable provenance and SBOM metadata for the remediation. From 219fe3c00e08eee7ab4682dc1f836ca4b858cdeb Mon Sep 17 00:00:00 2001 From: s-stumbo Date: Fri, 9 Oct 2026 13:42:17 -0400 Subject: [PATCH 2/3] Move Athena blurb into CVE remediation sections, drop its header Remove the heading from the `blurb/athena` shortcode so it reads as section body, and move the blurb into each page's CVE remediation section. Add a CVE remediation section to the general Libraries overview and the JavaScript overview, which previously had none. Co-Authored-By: Claude Opus 4.8 (1M context) --- content/chainguard/libraries/introduction/overview.md | 8 +++++--- content/chainguard/libraries/java/overview.md | 6 +++--- content/chainguard/libraries/javascript/overview.md | 8 +++++--- content/chainguard/libraries/python/overview.md | 6 +++--- layouts/shortcodes/blurb/athena.html | 2 -- 5 files changed, 16 insertions(+), 14 deletions(-) diff --git a/content/chainguard/libraries/introduction/overview.md b/content/chainguard/libraries/introduction/overview.md index f24785455b..62c9bebc26 100644 --- a/content/chainguard/libraries/introduction/overview.md +++ b/content/chainguard/libraries/introduction/overview.md @@ -6,7 +6,7 @@ description: "Learn about Chainguard Libraries, providing enhanced security for comprehensive supply chain protection." type: "article" date: 2025-03-25T08:04:00+00:00 -lastmod: 2026-10-09T17:17:40+00:00 +lastmod: 2026-10-09T17:42:18+00:00 draft: false tags: ["Chainguard Libraries", "Overview"] menu: @@ -31,8 +31,6 @@ social engineering campaigns and malware injections to exfiltrate enterprise secrets. Chainguard Libraries prevents malware instead of making developers pause work, triage incidents, and respond after compromise. -{{% blurb/athena %}} - ## Background Open source libraries distributed through public repositories face several @@ -123,6 +121,10 @@ To move an existing project over, follow the migration guide for [JavaScript](/chainguard/libraries/javascript/migration/), or [Python](/chainguard/libraries/python/migration/). +## CVE remediation + +{{% blurb/athena %}} + ## Chainguard criteria for building a library Chainguard Libraries includes thousands of Java, JavaScript, and Python libraries, and coverage is continuously growing as we add more packages and versions over time. Chainguard aims to build libraries that are relevant to our customers and that support broader software supply chain security goals. However, it is not always feasible or safe to rebuild and redistribute every package from public registries such as Maven Central, npm, or PyPI. diff --git a/content/chainguard/libraries/java/overview.md b/content/chainguard/libraries/java/overview.md index 0f834b9507..e6b5ff8f54 100644 --- a/content/chainguard/libraries/java/overview.md +++ b/content/chainguard/libraries/java/overview.md @@ -4,7 +4,7 @@ linktitle: "Java overview" description: "Learn about Chainguard Libraries for Java, providing enhanced security for Maven dependencies through automated vulnerability patching and supply chain protection" type: "article" date: 2025-03-25T08:04:00+00:00 -lastmod: 2026-10-09T17:17:40+00:00 +lastmod: 2026-10-09T17:42:18+00:00 draft: false tags: ["Chainguard Libraries", "Java", "Overview"] menu: @@ -47,8 +47,6 @@ continues to grow, and any request for a missing library or version automatically triggers a process to provision the artifacts from relevant sources if available. -{{% blurb/athena %}} - ## Runtime requirements The runtime requirements for Java artifacts available from Chainguard Libraries @@ -120,6 +118,8 @@ guide](/chainguard/libraries/java/migration/). ## CVE remediation +{{% blurb/athena %}} + Chainguard Libraries for Java includes the [CVE Remediation](/chainguard/libraries/policies-and-security/cve-remediation/) feature, available in beta for Spring Boot. Remediated libraries include an appended local version identifier of `-0.cgr.N`. diff --git a/content/chainguard/libraries/javascript/overview.md b/content/chainguard/libraries/javascript/overview.md index ea2dae8814..59ee9c9aa5 100644 --- a/content/chainguard/libraries/javascript/overview.md +++ b/content/chainguard/libraries/javascript/overview.md @@ -6,7 +6,7 @@ aliases: description: "JavaScript libraries for your application development" type: "article" date: 2025-06-05T09:00:00+00:00 -lastmod: 2026-10-09T17:17:40+00:00 +lastmod: 2026-10-09T17:42:18+00:00 draft: false tags: ["Chainguard Libraries", "JavaScript", "Overview"] menu: @@ -34,8 +34,6 @@ Repository](/chainguard/libraries/javascript/overview/), which provides a single endpoint for package retrieval and supports configurable security policies for both Chainguard-built and upstream packages. -{{% blurb/athena %}} - ## Background The main public repository for JavaScript packages is the [npm @@ -93,6 +91,10 @@ You can continue to use additional registries alongside Chainguard for needs out Configure this endpoint [globally through a repository manager](/chainguard/libraries/javascript/global-configuration/) for centralized access control across your organization, or use it for [direct access](/chainguard/libraries/javascript/build-configuration/) from individual build tools. If you prefer to manage your own npm fallback rather than using the built-in upstream fallback, refer to the [global configuration documentation](/chainguard/libraries/javascript/global-configuration/) for setup guides per repository manager. +## CVE remediation + +{{% blurb/athena %}} + ## Updating lockfile hashes Existing JavaScript lockfiles usually contain upstream integrity hashes. Because Chainguard rebuilds packages from verified source, those hashes must be updated before reinstalling. Use `chainctl libraries update-hashes` to update them in place. Learn more in [Build configuration](/chainguard/libraries/javascript/build-configuration/#updating-lockfile-hashes/). diff --git a/content/chainguard/libraries/python/overview.md b/content/chainguard/libraries/python/overview.md index 6bef1ceb3e..548a2ad6f4 100644 --- a/content/chainguard/libraries/python/overview.md +++ b/content/chainguard/libraries/python/overview.md @@ -4,7 +4,7 @@ linktitle: "Python overview" description: "Learn about Chainguard Libraries for Python, providing enhanced security for PyPI packages through automated vulnerability patching and supply chain protection" type: "article" date: 2025-04-09T04:00:00+00:00 -lastmod: 2026-10-09T17:17:40+00:00 +lastmod: 2026-10-09T17:42:18+00:00 draft: false tags: ["Chainguard Libraries", "Python", "Overview"] menu: @@ -33,8 +33,6 @@ sources if available. In combination with third-party software repository managers, you can use Chainguard Libraries for Python as a secure source of truth for your development process. -{{% blurb/athena %}} - ## Technical details Most organizations consume Chainguard Libraries for Python through a repository @@ -91,6 +89,8 @@ Python wheel files for standard and remediated package version. ## CVE remediation +{{% blurb/athena %}} + Chainguard Libraries for Python includes the [CVE Remediation](/chainguard/libraries/policies-and-security/cve-remediation/) feature. Remediated libraries include an appended local version identifier of `+cgr.N`. Python diff --git a/layouts/shortcodes/blurb/athena.html b/layouts/shortcodes/blurb/athena.html index c491ad12bc..8ac6da8e83 100644 --- a/layouts/shortcodes/blurb/athena.html +++ b/layouts/shortcodes/blurb/athena.html @@ -1,5 +1,3 @@ -## Zero-day protection, powered by Athena - Frontier AI models are uncovering vulnerabilities in open source software before traditional security tools can detect them. Chainguard Libraries helps reduce that exposure by delivering remediated artifacts through the [Athena](https://www.chainguard.dev/athena) coalition. Chainguard validates, patches, rebuilds, and tests affected packages, then makes the fixed artifacts available through Chainguard Libraries. Customers can continue using supported package versions while receiving verifiable provenance and SBOM metadata for the remediation. From 98eab86f3b4236615ad3bec667b10b0d8cc60aa2 Mon Sep 17 00:00:00 2001 From: s-stumbo Date: Fri, 16 Oct 2026 09:04:09 -0400 Subject: [PATCH 3/3] update wording Signed-off-by: s-stumbo --- layouts/shortcodes/blurb/athena.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/layouts/shortcodes/blurb/athena.html b/layouts/shortcodes/blurb/athena.html index 8ac6da8e83..44835b12ee 100644 --- a/layouts/shortcodes/blurb/athena.html +++ b/layouts/shortcodes/blurb/athena.html @@ -1,3 +1,3 @@ Frontier AI models are uncovering vulnerabilities in open source software before traditional security tools can detect them. Chainguard Libraries helps reduce that exposure by delivering remediated artifacts through the [Athena](https://www.chainguard.dev/athena) coalition. -Chainguard validates, patches, rebuilds, and tests affected packages, then makes the fixed artifacts available through Chainguard Libraries. Customers can continue using supported package versions while receiving verifiable provenance and SBOM metadata for the remediation. +Chainguard validates, patches, rebuilds, and tests affected packages, then makes the fixed artifacts available to Athena members through Chainguard Libraries. After public disclosure, Chainguard makes the fixes available to Chainguard customers through supported Chainguard Libraries ecosystems. Customers can continue using supported package versions while receiving verifiable provenance and SBOM metadata for the remediation.