IBM and Red Hat Expand Lightwell to Strengthen Trust and Governance for AI-Era Open Source

Details

IBM and Red Hat have announced commercial expansions of Lightwell, an open-source project built on Sigstore, in-toto, SLSA, and SBOM standards aimed at establishing verifiable trust for software supply chains. The new commercial offerings add artifact signing, provenance generation, policy validation, and lifecycle management as integrated capabilities.\n\nThe context driving the announcement is the rapid increase in AI-generated code entering enterprise pipelines. As AI tools accelerate software creation, traditional security reviews become insufficient. Organizations increasingly need cryptographic proof of where software originated, how it was built, whether it was modified, and whether it complies with security policy before deployment.\n\nLightwell integrates multiple existing security standards rather than treating signing, provenance, and policy as disconnected activities. IBM frames this as 'trust infrastructure' becoming a foundational enterprise requirement in the AI-assisted development era.\n\nThe target market is enterprises already using Sigstore, in-toto, or SLSA independently who want a unified commercial solution. The open-source foundation allows adoption without vendor commitment, with the commercial layer adding enterprise support and integration across the full delivery lifecycle.