Chainguard Libraries FAQ

Tue, 25 Mar 2025 08:04:00 +0000

How does Chainguard Libraries help developers?

Watch: How Chainguard Libraries helps developers

The following video focuses on Chainguard’s built-from-source model: when a rebuilt package is available, Chainguard serves it with verifiable provenance and SBOMs. Not every package or version can be built immediately, so the Chainguard Repository also supports an optional, policy-governed upstream fallback. When enabled, Chainguard-built packages are preferred, while eligible upstream packages are subject to configurable controls such as a cooldown period and malware and greyware scanning. Packages identified as malicious are blocked.

Transcript

Interviewer: So how does Chainguard Libraries help developers?

Dustin Kirkland: Yeah, so building off of that Chainguard Factory, we’ve actually repurposed all of that automation to not just build packages and containers, but actually fetch libraries directly from their upstream source and recompile those Java binaries—JARs—and those Python binaries—wheels—in a new format, or in the same format rather, but totally bootstrapped from source. The fact that we can rebuild those libraries means that we can actually patch them if necessary.

Now, in doing so, we’ve created an entire repository of Python wheels and Java JARs that we can publish and hydrate into a customer’s environment, so that their developers can retrieve their libraries from a secure source, from a trusted source, and avoid malicious packages—deliberately modified or intentionally compromised packages—which, you know, we find in PyPI.org or in Maven Central from time to time. But Chainguard building those from source ensures that that entire open source ecosystem is secured in the same way that we’re securing the packages and the container ecosystems.

Error messages

Tue, 11 Aug 2026 00:00:00 +0000

Chainguard Libraries applies security controls to every package it serves through the Chainguard Repository: malware and greyware scanning, and configurable policies such as a cooldown period. When one of these controls blocks a package or version, Chainguard withholds it and the install fails.

Chainguard also surfaces errors for other reasons, such as a missing entitlement or invalid authentication.

Note: If your build tool or repository manager pulls from a public registry as a fallback, it may fetch a blocked package and bypass Chainguard’s controls. Chainguard recommends pulling all open source packages through the Chainguard Repository only.

Chainguard Libraries troubleshooting and FAQ on

Chainguard Libraries FAQ

How does Chainguard Libraries help developers?

Transcript

Error messages