Note required entitlement and pull permission for libraries commands

Document that chainctl libraries update-hashes and verify each require an
ecosystem entitlement and the matching libraries.<ecosystem>.pull permission,
adding a note at each procedure step across the Python, JavaScript, and Java
libraries guides. Auto-generated chainctl reference pages are excluded.

Also fix a copy-paste error on the Python global-configuration page that
referred to "JavaScript lockfile formats."

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: s-stumbo

content/chainguard/libraries/java/build-configuration.md

@@ -4,7 +4,7 @@ linktitle: "Build configuration"
 description: "Configuring Chainguard Libraries for Java on your workstation"
 type: "article"
 date: 2025-03-25T08:04:00+00:00
-lastmod: 2026-08-03T18:16:45+00:00
+lastmod: 2026-08-05T18:42:36+00:00
 draft: false
 tags: ["Chainguard Libraries", "Java"]
 menu:
@@ -536,6 +536,8 @@ dependency added in the example project can be found at:
 
 To verify the artifact was built by Chainguard, use `chainctl`:
 
+> **Note**: Running `chainctl libraries verify` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for Java and the `libraries.java.pull` permission.
+
 ```bash
 chainctl libraries verify \
   ~/.m2/repository/com/google/guava/guava/33.4.0-jre/guava-33.4.0-jre.jar
@@ -779,6 +781,8 @@ find ~/.gradle/caches/modules-2/files-2.1/com.google.guava/guava -name "*.jar" |
 
 Then copy the exact path to the jar and verify it with `chainctl`:
 
+> **Note**: Running `chainctl libraries verify` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for Java and the `libraries.java.pull` permission.
+
 ```bash
 chainctl libraries verify --parent your-org /full/path/to/guava-<version>.jar
 ```

content/chainguard/libraries/java/migration.md

@@ -4,7 +4,7 @@ type: "article"
 linktitle: "Migrate to Chainguard"
 description: "How to migrate an existing Java project to pull dependencies from Chainguard Libraries"
 date: 2026-07-02T00:00:00+00:00
-lastmod: 2026-08-03T18:16:45+00:00
+lastmod: 2026-08-05T18:42:36+00:00
 tags: ["Chainguard Libraries", "Java"]
 menu:
   docs:
@@ -505,6 +505,8 @@ If all artifacts download from Central, your credentials may be invalid or expir
 
 To check whether a specific artifact was built by Chainguard, use `chainctl libraries verify /full/path/to/artifact.jar`. Verify artifacts immediately after a clean build, before any repackaging.
 
+> **Note**: Running `chainctl libraries verify` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for Java and the `libraries.java.pull` permission.
+
 When upstream fallback is enabled, [packages that aren't built by Chainguard] are subject to Chainguard's security controls.
 
 {{< tabs >}}

content/chainguard/libraries/javascript/build-configuration.md

@@ -4,7 +4,7 @@ linktitle: "Build configuration"
 description: "Configuring Chainguard Libraries for JavaScript on your workstation"
 type: "article"
 date: 2025-06-05T09:00:00+00:00
-lastmod: 2026-08-03T18:16:45+00:00
+lastmod: 2026-08-05T18:42:36+00:00
 draft: false
 tags: ["Chainguard Libraries", "JavaScript"]
 menu:
@@ -84,6 +84,8 @@ Learn more in the [JavaScript migration guide](/chainguard/libraries/javascript/
 `update-hashes` fetches checksums from Chainguard Libraries,
 which requires authentication. Where it fetches from depends on your environment: some setups authenticate directly to `libraries.cgr.dev`, but if your build routes through a repository manager configured as a pull-through proxy for Chainguard Libraries, point `update-hashes` there instead with `--registry-url` so it validates against the same source your build used.
 
+> **Note**: Running `chainctl libraries update-hashes` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for JavaScript and the `libraries.javascript.pull` permission.
+
 Authenticating to `libraries.cgr.dev` directly:
 
 - **Logged in locally**: Run the command while authenticated; if you have no

content/chainguard/libraries/javascript/global-configuration.md

@@ -4,7 +4,7 @@ linktitle: "Global configuration"
 description: "Configuring Chainguard Libraries for JavaScript in your organization"
 type: "article"
 date: 2025-06-05T09:00:00+00:00
-lastmod: 2026-07-29T13:35:56+00:00
+lastmod: 2026-08-05T18:42:36+00:00
 draft: false
 tags: ["Chainguard Libraries", "JavaScript"]
 images: []
@@ -72,6 +72,8 @@ this page follow this pattern.
 If you are migrating an existing JavaScript project to Chainguard Libraries through a repository manager, your lockfile likely contains integrity hashes generated against packages previously downloaded from npm or through your repository manager. The [`chainctl libraries update-hashes` command](/chainguard/chainctl/chainctl-docs/chainctl_libraries_update-hashes/) automates lockfile hash updates
 for all supported JavaScript lockfile formats.
 
+> **Note**: Running `chainctl libraries update-hashes` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for JavaScript and the `libraries.javascript.pull` permission.
+
 When you are using a repository manager, pass the full repository manager URL with `--registry-url` and authenticate with one of the supported methods: `--username` and `--password`, `--token`, or a `.netrc` entry for the registry host. For example:
 
 ```bash

content/chainguard/libraries/javascript/migration.md

@@ -4,7 +4,7 @@ type: "article"
 linktitle: "Migrate to Chainguard"
 description: "How to migrate an existing JavaScript project to pull dependencies from Chainguard Libraries"
 date: 2026-06-01T00:00:00+00:00
-lastmod: 2026-08-03T18:16:45+00:00
+lastmod: 2026-08-05T18:42:36+00:00
 tags: ["Chainguard Libraries", "JavaScript"]
 menu:
   docs:
@@ -402,6 +402,8 @@ Chainguard's artifacts, without regenerating the lockfile from scratch. This
 preserves your pinned dependency versions. Supported formats include `package-lock.json` (npm v2/v3), `yarn.lock` (Yarn
 Classic and Berry), `pnpm-lock.yaml`, and `bun.lock`.
 
+> **Note**: Running `chainctl libraries update-hashes` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for JavaScript and the `libraries.javascript.pull` permission.
+
 Run the command in the directory containing the lockfile:
 
 ```shell
@@ -632,6 +634,8 @@ their directory structure.
 
 When upstream fallback is enabled, [packages that aren't built by Chainguard](#packages-not-available-in-chainguard-libraries) are subject to Chainguard's security controls.
 
+> **Note**: Running `chainctl libraries verify` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for JavaScript and the `libraries.javascript.pull` permission.
+
 {{< tabs >}}
 
 {{% tab title="npm" %}}

content/chainguard/libraries/python/build-configuration.md

@@ -4,7 +4,7 @@ linktitle: "Build configuration"
 description: "Configuring Chainguard Libraries for Python on your workstation"
 type: "article"
 date: 2025-03-25T08:04:00+00:00
-lastmod: 2026-08-03T18:16:45+00:00
+lastmod: 2026-08-05T18:42:36+00:00
 draft: false
 tags: ["Chainguard Libraries", "Python"]
 menu:
@@ -165,6 +165,8 @@ The [`chainctl libraries update-hashes` command](/chainguard/chainctl/chainctl-d
 
 Supported formats include `requirements.txt` (pip-tools `--hash` style), `poetry.lock`, `uv.lock`, `pdm.lock`, `Pipfile.lock`, and `pylock.toml`.
 
+> **Note**: Running `chainctl libraries update-hashes` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for Python and the `libraries.python.pull` permission.
+
 Run the command in your project directory to auto-detect the lockfile:
 
 ```bash

content/chainguard/libraries/python/global-configuration.md

@@ -4,7 +4,7 @@ linktitle: "Global configuration"
 description: "Configuring Chainguard Libraries for Python in your organization"
 type: "article"
 date: 2025-03-25T08:04:00+00:00
-lastmod: 2026-08-03T18:16:45+00:00
+lastmod: 2026-08-05T18:42:36+00:00
 draft: false
 tags: ["Chainguard Libraries", "Python"]
 images: []
@@ -69,7 +69,9 @@ However, if you intentionally want to manage fallback ordering yourself, you can
 ### Updating lockfile hashes
 
 If you are migrating an existing Python project to Chainguard Libraries through a repository manager, your lockfile likely contains integrity hashes generated against packages previously downloaded from PyPI or through your repository manager. The [`chainctl libraries update-hashes` command](/chainguard/chainctl/chainctl-docs/chainctl_libraries_update-hashes/) automates lockfile hash updates
-for all supported JavaScript lockfile formats.
+for all supported Python lockfile formats.
+
+> **Note**: Running `chainctl libraries update-hashes` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for Python and the `libraries.python.pull` permission.
 
 When you are using a repository manager, pass the full repository manager URL with `--registry-url` and authenticate with one of the supported methods: `--username` and `--password`, `--token`, or a `.netrc` entry for the registry host. For example:
 

content/chainguard/libraries/python/migration.md

@@ -4,7 +4,7 @@ type: "article"
 linktitle: "Migrate to Chainguard"
 description: "How to migrate an existing Python project to pull dependencies from Chainguard Libraries"
 date: 2026-07-14T00:00:00+00:00
-lastmod: 2026-07-31T18:47:05+00:00
+lastmod: 2026-08-05T18:42:36+00:00
 tags: ["Chainguard Libraries", "Python"]
 menu:
   docs:
@@ -312,6 +312,8 @@ Your existing lockfile or hash-pinned `requirements.txt` contains checksums gene
 
 Use `chainctl libraries update-hashes` to rewrite only the integrity hashes in your existing lockfile or requirements file to match Chainguard's artifacts, without re-resolving your dependency graph. Supported formats include `requirements.txt`, `poetry.lock`, `uv.lock`, `pdm.lock`, `Pipfile.lock`, and `pylock.toml`.
 
+> **Note**: Running `chainctl libraries update-hashes` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for Python and the `libraries.python.pull` permission.
+
 Run the following command to auto-detect and update the lockfile in the current project:
 
 ```bash
@@ -445,6 +447,8 @@ poetry install
 
 After reinstalling, you can use `chainctl` to verify which dependencies are built by Chainguard. When upstream fallback is enabled, [libraries that aren't built by Chainguard](#packages-not-available-in-chainguard-libraries) are subject to Chainguard's security controls.
 
+> **Note**: Running `chainctl libraries verify` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for Python and the `libraries.python.pull` permission.
+
 {{< tabs >}}
 
 {{% tab title="pip and uv" %}}

content/chainguard/libraries/quickstart.md

@@ -4,7 +4,7 @@ linktitle: "Quick Start"
 description: "Learn how to get started with Chainguard Libraries"
 type: "article"
 date: 2025-03-25T00:08:04+00:00
-lastmod: 2026-08-03T18:16:45+00:00
+lastmod: 2026-08-05T18:42:36+00:00
 draft: false
 tags: ["Chainguard Libraries"]
 menu:
@@ -255,6 +255,8 @@ Check out minimal example projects for
 
 After setup, you can verify which dependencies were built from source by Chainguard:
 
+> **Note**: Running `chainctl libraries verify` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for the ecosystem you're verifying and the matching pull permission (`libraries.java.pull`, `libraries.javascript.pull`, or `libraries.python.pull`).
+
 ```bash
 chainctl libraries verify /path/to/artifact
 ```

content/chainguard/libraries/verification.md

@@ -6,7 +6,7 @@ description:
   Libraries using the chainctl tool for enhanced supply chain security"
 type: "article"
 date: 2025-07-03T12:00:00+00:00
-lastmod: 2026-08-03T18:16:45+00:00
+lastmod: 2026-08-05T18:42:36+00:00
 draft: false
 tags: ["Chainguard Libraries"]
 menu:
@@ -51,7 +51,10 @@ You also need:
 - A Linux, macOS, or Windows system (x86_64 or arm64)
 - Sufficient [network access](/chainguard/libraries/network-requirements/)
 - Your organization [must include entitlement for access to Chainguard
-  Libraries](/chainguard/libraries/access/#entitlement)
+  Libraries](/chainguard/libraries/access/#entitlement) for the ecosystem you're
+  verifying, and your identity must have the matching pull permission
+  (`libraries.java.pull`, `libraries.javascript.pull`, or
+  `libraries.python.pull`)
 
 Confirm that `chainctl` and `cosign` are installed and available on the `PATH`
 with the following commands: