Analyze package coverage with Lightwell Lens

Use Lightwell Lens to compare your application's dependencies with the packages available in the Lightwell Network catalog.

Before you begin
Copy link

  • You have access to Lightwell Network.
  • You can log in to the Red Hat Hybrid Cloud Console.
  • You have a supported dependency file to analyze. For more information, see Lightwell Lens.

Procedure

  1. Log in to the Red Hat Hybrid Cloud Console at console.redhat.com.
  2. Navigate to Lightwell.
  3. Select the Lens tab.
  4. Prepare one of the following supported files:
    • A CycloneDX-formatted SBOM.
    • An SPDX-formatted SBOM.
    • A Maven pom.xml file.
    • A requirements.txt file.
    • A CSV file containing package URLs (PURLs), with one PURL per line.
  5. Upload the file to Lightwell Lens.
  6. Review the package coverage summary.
    • Exact Match indicates packages for which both the package name and version are present in the Lightwell Network catalog.
    • Partial Match indicates packages for which the package name is present, but the specified version is not.
    • No Match indicates packages that are not present in the Lightwell Network catalog.
  7. Review Ecosystem Breakdown for package coverage grouped by software ecosystem.
  8. Review Fixed CVEs to see the number of CVEs fixed by using matching packages from the Lightwell Network catalog, categorized as Critical, Important, Moderate, or Low.

Results
Copy link

Lens displays the coverage of the packages contained in the uploaded file against the Lightwell Network catalog.