# Red Hat launches Lightwell to backport and sign open-source patches

> **Key takeaway:** Red Hat and IBM introduced Lightwell, a service that actively backports, tests, and cryptographically signs patches for open-source dependencies before upstream fixes are available.

**Published:** 2026-10-19T00:00:00+00:00 
**Source:** Red Hat Blog 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/red-hat-launches-lightwell-to-backport-and-sign-open-source-.html 

## Summary
Red Hat and IBM have launched Lightwell, a supply-chain security service that backports and signs patches for vulnerabilities in open-source dependencies. The company claims many organizations take 40 to 90 days to move patches into production, a gap that now exceeds AI-accelerated exploit windows measured in hours. Lightwell integrates with Red Hat OpenShift and a "trusted software factory" to automate rebuild, attestation, and policy-gated deployment of remediated components.

## How Lightwell fits into Red Hat's patch pipeline
- Lightwell backports fixes for dependencies including cases where "the upstream project has not addressed" the vulnerability yet
- Delivers "version-specific, remediated component[s]" rather than generic updates
- Relies on a "trusted software factory" between patch source and production: rebuild, sign, attest, and policy-gate
- Targets deployment across "hybrid estate, data center, cloud, and edge"
- Produces "cryptographic proof of exactly what changed" for audit/regulatory purposes
- Uses progressive delivery for live traffic validation of patches

## Why it matters
If widely adopted, Lightwell could reduce duplicated security labor across enterprises by centralizing backporting and testing at the vendor level. However, it also increases dependency on Red Hat's signing infrastructure for critical fixes that may not yet exist upstream.