@nprofile1q... as of Monday I'm leading one of the Engineering Teams working on Lightwell. I have every intention of delivering on the promises we've made to both the customer and the open source community.

@nprofile1q... this paragraph from the press release is of note:

"Lightwell operates under Red Hat’s proven upstream-always model, in which security fixes are actively submitted back to the originating open source community for review and acceptance. This ensures commercial protections and community health continually reinforce one another, preventing project fragmentation without risking in-production zero days."

@nprofile1q... I don't fully understand your line of questions. Project Lightwell isn't just "we find vulnerabilities and report them placing burden on the project" it's "we find them, fix them, and contribute them upstream in a responsible manner" (embargos and such). The value prop for customers is we will also backport those fixes to whatever version of the software (and its dependency chain) that the customer wants/needs. If those versions are still maintained upstream, we'll contribute to those too.

@nprofile1q... yes, all security fixes go upstream.

@nprofile1q... I don't know on both items but will find out.

@nprofile1q... try it out 🙂

@nprofile1q... @nprofile1q... I'm not sure I follow, it's the same goose package that's in Fedora and CentOS Stream. The only difference is without the x509 cert issued by subscription manager, you can't access the default inference provider that's preconfigured in goose-redhat.

@nprofile1q... @nprofile1q... I honestly don't know. I'm sure there's a public list somewhere, at a minimum it has to exist for CVE data. If you can't find it by web search or your AI agent of choice, I'll ask around next time I'm at my keyboard and get back to you.

@nprofile1q... it's an open source project, so however you deem appropriate to calculate that 🤷