--- title: IBM and Red Hat Expand Lightwell to Strengthen Trust and... description: IBM and Red Hat have expanded Lightwell with new commercial offerings aimed at building trust infrastructure for AI-era software supply chains. The platform... canonical: https://daily.dev/posts/ibm-and-red-hat-expand-lightwell-to-strengthen-trust-and-governance-for-ai-era-open-source-8xuuh89h3 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: IBM and Red Hat Expand Lightwell to Strengthen Trust and Governance for AI-Era Open Source | daily.dev og:description: IBM and Red Hat have expanded Lightwell with new commercial offerings aimed at building trust infrastructure for AI-era software supply chains. The platform... og:url: https://daily.dev/posts/ibm-and-red-hat-expand-lightwell-to-strengthen-trust-and-governance-for-ai-era-open-source-8xuuh89h3 og:image: https://api.daily.dev/og/posts/8XuuH89H3.png og:image:alt: IBM and Red Hat Expand Lightwell to Strengthen Trust and Governance for AI-Era Open Source og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # IBM and Red Hat Expand Lightwell to Strengthen Trust and Governance for AI-Era Open Source **[InfoQ](https://daily.dev/sources/infoq)** · 4 min read · 0 upvotes · 0 comments ## Summary IBM and Red Hat have expanded Lightwell with new commercial offerings aimed at building trust infrastructure for AI-era software supply chains. The platform integrates established security standards — Sigstore, in-toto, SLSA, and SBOM — into a cohesive solution covering artifact signing, provenance generation, policy validation, and lifecycle management. The expansion addresses a growing challenge: as AI accelerates code generation and autonomous workflows, organizations need cryptographic proof of where software originated, how it was built, and whether it has been tampered with. Lightwell positions itself as an enterprise-ready platform that operationalizes these standards without requiring organizations to assemble multiple disconnected open-source tools. The move is part of a broader industry trend, with GitHub, Google, Microsoft, and the CNCF all expanding supply chain security capabilities. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Lightwell and what security standards does it integrate? Lightwell is an open-source project from IBM and Red Hat that integrates Sigstore, in-toto, SLSA (Supply-chain Levels for Software Artifacts), and SBOM initiatives into a unified platform. It covers artifact signing, provenance generation, policy validation, and lifecycle management, enabling organizations to verify every stage of software delivery without assembling multiple disconnected open-source tools themselves. _Teams evaluating software supply chain platforms track announcements like this on daily.dev._ ### How does software supply chain security need to change when AI agents are generating and modifying code? When AI agents generate code, modify infrastructure, or contribute to software delivery, organizations need mechanisms to verify which identity performed each action and under which policies — not just whether the code is functional. This requires cryptographic attestations, workload identity, and policy-as-code so that trust accompanies every artifact from development through deployment, covering both human and AI-generated contributions. _Engineers building governance frameworks for AI-assisted pipelines follow developments like these on daily.dev._ ## Similar posts on daily.dev - [IBM and Red Hat Expand Lightwell with New Offerings to Build the Trust Infrastructure for AI-Era Open Source](https://daily.dev/posts/ibm-and-red-hat-expand-lightwell-with-new-offerings-to-build-the-trust-infrastructure-for-ai-era-ope-xmnogip8m) · SD Times · 0 upvotes · 0 comments - [IBM and Red Hat Launch Lightwell Catalog to Automate Remediation](https://daily.dev/posts/ibm-and-red-hat-launch-lightwell-catalog-to-automate-remediation-3zr1ruijc) · DevOps.com · 0 upvotes · 0 comments - [Anthropic's AI Finds Bugs. IBM Bets $5B It Can Fix Them.](https://daily.dev/posts/anthropic-s-ai-finds-bugs-ibm-bets-5b-it-can-fix-them--pcqmqq3sh) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#supply-chain](https://daily.dev/tags/supply-chain), [#sbom](https://daily.dev/tags/sbom) [View this post on daily.dev](https://daily.dev/posts/ibm-and-red-hat-expand-lightwell-to-strengthen-trust-and-governance-for-ai-era-open-source-8xuuh89h3) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"IBM and Red Hat Expand Lightwell to Strengthen Trust and Governance for AI-Era Open Source","url":"https://daily.dev/posts/ibm-and-red-hat-expand-lightwell-to-strengthen-trust-and-governance-for-ai-era-open-source-8xuuh89h3","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ibm-and-red-hat-expand-lightwell-to-strengthen-trust-and-governance-for-ai-era-open-source-8xuuh89h3"},"datePublished":"2026-08-11T12:03:39.060Z","dateModified":"2026-08-11T12:04:04.406Z","description":"IBM and Red Hat have expanded Lightwell with new commercial offerings aimed at building trust infrastructure for AI-era software supply chains. The platform...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/491322db575352a6b426644e5e015d08?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/491322db575352a6b426644e5e015d08?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ibm-and-red-hat-expand-lightwell-to-strengthen-trust-and-governance-for-ai-era-open-source-8xuuh89h3","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"supply-chain,sbom","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"IBM and Red Hat Expand Lightwell to Strengthen Trust and Governance for AI-Era Open Source"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ibm-and-red-hat-expand-lightwell-to-strengthen-trust-and-governance-for-ai-era-open-source-8xuuh89h3#faq","mainEntity":[{"@type":"Question","name":"What is Lightwell and what security standards does it integrate?","acceptedAnswer":{"@type":"Answer","text":"Lightwell is an open-source project from IBM and Red Hat that integrates Sigstore, in-toto, SLSA (Supply-chain Levels for Software Artifacts), and SBOM initiatives into a unified platform. It covers artifact signing, provenance generation, policy validation, and lifecycle management, enabling organizations to verify every stage of software delivery without assembling multiple disconnected open-source tools themselves. Teams evaluating software supply chain platforms track announcements like this on daily.dev."}},{"@type":"Question","name":"How does software supply chain security need to change when AI agents are generating and modifying code?","acceptedAnswer":{"@type":"Answer","text":"When AI agents generate code, modify infrastructure, or contribute to software delivery, organizations need mechanisms to verify which identity performed each action and under which policies — not just whether the code is functional. This requires cryptographic attestations, workload identity, and policy-as-code so that trust accompanies every artifact from development through deployment, covering both human and AI-generated contributions. Engineers building governance frameworks for AI-assisted pipelines follow developments like these on daily.dev."}}]} ```