Simplify libraries permission notes and place after command

Reword the update-hashes and verify permission notes to name only the pull
permission or the Owner role, dropping the entitlement mention, and move each
note to immediately after the command code block.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: s-stumbo

content/chainguard/libraries/java/build-configuration.md

@@ -4,7 +4,7 @@ linktitle: "Build configuration"
 description: "Configuring Chainguard Libraries for Java on your workstation"
 type: "article"
 date: 2025-03-25T08:04:00+00:00
-lastmod: 2026-08-05T18:42:36+00:00
+lastmod: 2026-08-05T19:13:35+00:00
 draft: false
 tags: ["Chainguard Libraries", "Java"]
 menu:
@@ -536,13 +536,13 @@ dependency added in the example project can be found at:
 
 To verify the artifact was built by Chainguard, use `chainctl`:
 
-> **Note**: Running `chainctl libraries verify` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for Java and the `libraries.java.pull` permission.
-
 ```bash
 chainctl libraries verify \
   ~/.m2/repository/com/google/guava/guava/33.4.0-jre/guava-33.4.0-jre.jar
 ```
 
+> **Note**: Running `chainctl libraries verify` requires the `libraries.java.pull` permission or the Owner role.
+
 A successfully verified artifact produces output similar to the following:
 
 ```bash
@@ -781,12 +781,12 @@ find ~/.gradle/caches/modules-2/files-2.1/com.google.guava/guava -name "*.jar" |
 
 Then copy the exact path to the jar and verify it with `chainctl`:
 
-> **Note**: Running `chainctl libraries verify` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for Java and the `libraries.java.pull` permission.
-
 ```bash
 chainctl libraries verify --parent your-org /full/path/to/guava-<version>.jar
 ```
 
+> **Note**: Running `chainctl libraries verify` requires the `libraries.java.pull` permission or the Owner role.
+
 A successfully verified artifact produces output similar to the following:
 
 ```bash

content/chainguard/libraries/java/migration.md

@@ -4,7 +4,7 @@ type: "article"
 linktitle: "Migrate to Chainguard"
 description: "How to migrate an existing Java project to pull dependencies from Chainguard Libraries"
 date: 2026-07-02T00:00:00+00:00
-lastmod: 2026-08-05T18:42:36+00:00
+lastmod: 2026-08-05T19:13:35+00:00
 tags: ["Chainguard Libraries", "Java"]
 menu:
   docs:
@@ -505,8 +505,6 @@ If all artifacts download from Central, your credentials may be invalid or expir
 
 To check whether a specific artifact was built by Chainguard, use `chainctl libraries verify /full/path/to/artifact.jar`. Verify artifacts immediately after a clean build, before any repackaging.
 
-> **Note**: Running `chainctl libraries verify` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for Java and the `libraries.java.pull` permission.
-
 When upstream fallback is enabled, [packages that aren't built by Chainguard] are subject to Chainguard's security controls.
 
 {{< tabs >}}
@@ -588,6 +586,8 @@ chainctl libraries verify ~/Library/Caches/bazel/_bazel_example/c22a55500...f423
 
 {{< /tabs >}}
 
+> **Note**: Running `chainctl libraries verify` requires the `libraries.java.pull` permission or the Owner role.
+
 A successful result shows what percentage of your project's dependencies were built by Chainguard:
 
 ```bash

content/chainguard/libraries/javascript/build-configuration.md

@@ -4,7 +4,7 @@ linktitle: "Build configuration"
 description: "Configuring Chainguard Libraries for JavaScript on your workstation"
 type: "article"
 date: 2025-06-05T09:00:00+00:00
-lastmod: 2026-08-05T18:42:36+00:00
+lastmod: 2026-08-05T19:13:35+00:00
 draft: false
 tags: ["Chainguard Libraries", "JavaScript"]
 menu:
@@ -84,7 +84,7 @@ Learn more in the [JavaScript migration guide](/chainguard/libraries/javascript/
 `update-hashes` fetches checksums from Chainguard Libraries,
 which requires authentication. Where it fetches from depends on your environment: some setups authenticate directly to `libraries.cgr.dev`, but if your build routes through a repository manager configured as a pull-through proxy for Chainguard Libraries, point `update-hashes` there instead with `--registry-url` so it validates against the same source your build used.
 
-> **Note**: Running `chainctl libraries update-hashes` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for JavaScript and the `libraries.javascript.pull` permission.
+> **Note**: Running `chainctl libraries update-hashes` requires the `libraries.javascript.pull` permission or the Owner role.
 
 Authenticating to `libraries.cgr.dev` directly:
 

content/chainguard/libraries/javascript/global-configuration.md

@@ -4,7 +4,7 @@ linktitle: "Global configuration"
 description: "Configuring Chainguard Libraries for JavaScript in your organization"
 type: "article"
 date: 2025-06-05T09:00:00+00:00
-lastmod: 2026-08-05T18:42:36+00:00
+lastmod: 2026-08-05T19:13:35+00:00
 draft: false
 tags: ["Chainguard Libraries", "JavaScript"]
 images: []
@@ -72,8 +72,6 @@ this page follow this pattern.
 If you are migrating an existing JavaScript project to Chainguard Libraries through a repository manager, your lockfile likely contains integrity hashes generated against packages previously downloaded from npm or through your repository manager. The [`chainctl libraries update-hashes` command](/chainguard/chainctl/chainctl-docs/chainctl_libraries_update-hashes/) automates lockfile hash updates
 for all supported JavaScript lockfile formats.
 
-> **Note**: Running `chainctl libraries update-hashes` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for JavaScript and the `libraries.javascript.pull` permission.
-
 When you are using a repository manager, pass the full repository manager URL with `--registry-url` and authenticate with one of the supported methods: `--username` and `--password`, `--token`, or a `.netrc` entry for the registry host. For example:
 
 ```bash
@@ -82,6 +80,8 @@ chainctl libraries update-hashes \
   --token "$REPO_TOKEN"
 ```
 
+> **Note**: Running `chainctl libraries update-hashes` requires the `libraries.javascript.pull` permission or the Owner role.
+
 After updating the lockfile, keep your repository manager configuration in place and reinstall through the same repository manager endpoint to apply the updated hashes.
 
 Learn more in the [Build configuration page](/chainguard/libraries/javascript/build-configuration/#updating-lockfile-hashes/) and in the [chainctl docs](/chainguard/chainctl/chainctl-docs/chainctl_libraries_update-hashes/).

content/chainguard/libraries/javascript/migration.md

@@ -4,7 +4,7 @@ type: "article"
 linktitle: "Migrate to Chainguard"
 description: "How to migrate an existing JavaScript project to pull dependencies from Chainguard Libraries"
 date: 2026-06-01T00:00:00+00:00
-lastmod: 2026-08-05T18:42:36+00:00
+lastmod: 2026-08-05T19:13:35+00:00
 tags: ["Chainguard Libraries", "JavaScript"]
 menu:
   docs:
@@ -402,14 +402,14 @@ Chainguard's artifacts, without regenerating the lockfile from scratch. This
 preserves your pinned dependency versions. Supported formats include `package-lock.json` (npm v2/v3), `yarn.lock` (Yarn
 Classic and Berry), `pnpm-lock.yaml`, and `bun.lock`.
 
-> **Note**: Running `chainctl libraries update-hashes` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for JavaScript and the `libraries.javascript.pull` permission.
-
 Run the command in the directory containing the lockfile:
 
 ```shell
 chainctl libraries update-hashes
 ```
 
+> **Note**: Running `chainctl libraries update-hashes` requires the `libraries.javascript.pull` permission or the Owner role.
+
 If your build tool appends the Chainguard hashes to your lock file, include the flag `--replace` to ensure the hashes are replaced with Chainguard hashes. When using a repo manager, pass the full repository URL with `--registry-url`.
 
 You can also specify a lockfile path directly:
@@ -634,8 +634,6 @@ their directory structure.
 
 When upstream fallback is enabled, [packages that aren't built by Chainguard](#packages-not-available-in-chainguard-libraries) are subject to Chainguard's security controls.
 
-> **Note**: Running `chainctl libraries verify` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for JavaScript and the `libraries.javascript.pull` permission.
-
 {{< tabs >}}
 
 {{% tab title="npm" %}}
@@ -689,6 +687,8 @@ chainctl libraries verify ./node_modules
 
 {{< /tabs >}}
 
+> **Note**: Running `chainctl libraries verify` requires the `libraries.javascript.pull` permission or the Owner role.
+
 A successful result shows what percentage of your project's dependencies were built by Chainguard. For example:
 
 ```

content/chainguard/libraries/python/build-configuration.md

@@ -4,7 +4,7 @@ linktitle: "Build configuration"
 description: "Configuring Chainguard Libraries for Python on your workstation"
 type: "article"
 date: 2025-03-25T08:04:00+00:00
-lastmod: 2026-08-05T18:42:36+00:00
+lastmod: 2026-08-05T19:13:35+00:00
 draft: false
 tags: ["Chainguard Libraries", "Python"]
 menu:
@@ -165,14 +165,14 @@ The [`chainctl libraries update-hashes` command](/chainguard/chainctl/chainctl-d
 
 Supported formats include `requirements.txt` (pip-tools `--hash` style), `poetry.lock`, `uv.lock`, `pdm.lock`, `Pipfile.lock`, and `pylock.toml`.
 
-> **Note**: Running `chainctl libraries update-hashes` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for Python and the `libraries.python.pull` permission.
-
 Run the command in your project directory to auto-detect the lockfile:
 
 ```bash
 chainctl libraries update-hashes
 ```
 
+> **Note**: Running `chainctl libraries update-hashes` requires the `libraries.python.pull` permission or the Owner role.
+
 Or specify a lockfile path directly:
 
 ```bash

content/chainguard/libraries/python/global-configuration.md

@@ -4,7 +4,7 @@ linktitle: "Global configuration"
 description: "Configuring Chainguard Libraries for Python in your organization"
 type: "article"
 date: 2025-03-25T08:04:00+00:00
-lastmod: 2026-08-05T18:42:36+00:00
+lastmod: 2026-08-05T19:13:35+00:00
 draft: false
 tags: ["Chainguard Libraries", "Python"]
 images: []
@@ -71,8 +71,6 @@ However, if you intentionally want to manage fallback ordering yourself, you can
 If you are migrating an existing Python project to Chainguard Libraries through a repository manager, your lockfile likely contains integrity hashes generated against packages previously downloaded from PyPI or through your repository manager. The [`chainctl libraries update-hashes` command](/chainguard/chainctl/chainctl-docs/chainctl_libraries_update-hashes/) automates lockfile hash updates
 for all supported Python lockfile formats.
 
-> **Note**: Running `chainctl libraries update-hashes` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for Python and the `libraries.python.pull` permission.
-
 When you are using a repository manager, pass the full repository manager URL with `--registry-url` and authenticate with one of the supported methods: `--username` and `--password`, `--token`, or a `.netrc` entry for the registry host. For example:
 
 ```bash
@@ -81,6 +79,8 @@ chainctl libraries update-hashes \
   --token "$REPO_TOKEN"
 ```
 
+> **Note**: Running `chainctl libraries update-hashes` requires the `libraries.python.pull` permission or the Owner role.
+
 After updating the lockfile, keep your repository manager configuration in place and reinstall through the same repository manager endpoint to apply the updated hashes.
 
 Learn more in the [Build configuration page](/chainguard/libraries/python/build-configuration/#updating-lockfile-hashes/) and in the [chainctl docs](/chainguard/chainctl/chainctl-docs/chainctl_libraries_update-hashes/).

content/chainguard/libraries/python/migration.md

@@ -4,7 +4,7 @@ type: "article"
 linktitle: "Migrate to Chainguard"
 description: "How to migrate an existing Python project to pull dependencies from Chainguard Libraries"
 date: 2026-07-14T00:00:00+00:00
-lastmod: 2026-08-05T18:42:36+00:00
+lastmod: 2026-08-05T19:13:35+00:00
 tags: ["Chainguard Libraries", "Python"]
 menu:
   docs:
@@ -312,14 +312,14 @@ Your existing lockfile or hash-pinned `requirements.txt` contains checksums gene
 
 Use `chainctl libraries update-hashes` to rewrite only the integrity hashes in your existing lockfile or requirements file to match Chainguard's artifacts, without re-resolving your dependency graph. Supported formats include `requirements.txt`, `poetry.lock`, `uv.lock`, `pdm.lock`, `Pipfile.lock`, and `pylock.toml`.
 
-> **Note**: Running `chainctl libraries update-hashes` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for Python and the `libraries.python.pull` permission.
-
 Run the following command to auto-detect and update the lockfile in the current project:
 
 ```bash
 chainctl libraries update-hashes
 ```
 
+> **Note**: Running `chainctl libraries update-hashes` requires the `libraries.python.pull` permission or the Owner role.
+
 Or specify the lockfile when running the command. For example:
 
 ```bash
@@ -447,8 +447,6 @@ poetry install
 
 After reinstalling, you can use `chainctl` to verify which dependencies are built by Chainguard. When upstream fallback is enabled, [libraries that aren't built by Chainguard](#packages-not-available-in-chainguard-libraries) are subject to Chainguard's security controls.
 
-> **Note**: Running `chainctl libraries verify` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for Python and the `libraries.python.pull` permission.
-
 {{< tabs >}}
 
 {{% tab title="pip and uv" %}}
@@ -477,6 +475,8 @@ chainctl libraries verify --detailed $(poetry env info --path)
 
 {{< /tabs >}}
 
+> **Note**: Running `chainctl libraries verify` requires the `libraries.python.pull` permission or the Owner role.
+
 A successful result shows what percentage of your project's dependencies were built by Chainguard.
 
 For full details on verification options and output, check out [Verification: Analyze Python packages](/chainguard/libraries/verification/#analyze-python-packages).

content/chainguard/libraries/quickstart.md

@@ -4,7 +4,7 @@ linktitle: "Quick Start"
 description: "Learn how to get started with Chainguard Libraries"
 type: "article"
 date: 2025-03-25T00:08:04+00:00
-lastmod: 2026-08-05T18:42:36+00:00
+lastmod: 2026-08-05T19:13:35+00:00
 draft: false
 tags: ["Chainguard Libraries"]
 menu:
@@ -255,12 +255,12 @@ Check out minimal example projects for
 
 After setup, you can verify which dependencies were built from source by Chainguard:
 
-> **Note**: Running `chainctl libraries verify` requires an [entitlement to Chainguard Libraries](/chainguard/libraries/access/#entitlement) for the ecosystem you're verifying and the matching pull permission (`libraries.java.pull`, `libraries.javascript.pull`, or `libraries.python.pull`).
-
 ```bash
 chainctl libraries verify /path/to/artifact
 ```
 
+> **Note**: Running `chainctl libraries verify` requires one of the `libraries.java.pull`, `libraries.javascript.pull`, or `libraries.python.pull` permissions, or the Owner role.
+
 Learn more in [Chainguard Libraries verification](/chainguard/libraries/verification/).
 
 ## FAQs

content/chainguard/libraries/verification.md

@@ -6,7 +6,7 @@ description:
   Libraries using the chainctl tool for enhanced supply chain security"
 type: "article"
 date: 2025-07-03T12:00:00+00:00
-lastmod: 2026-08-05T18:42:36+00:00
+lastmod: 2026-08-05T19:13:35+00:00
 draft: false
 tags: ["Chainguard Libraries"]
 menu:
@@ -51,10 +51,7 @@ You also need:
 - A Linux, macOS, or Windows system (x86_64 or arm64)
 - Sufficient [network access](/chainguard/libraries/network-requirements/)
 - Your organization [must include entitlement for access to Chainguard
-  Libraries](/chainguard/libraries/access/#entitlement) for the ecosystem you're
-  verifying, and your identity must have the matching pull permission
-  (`libraries.java.pull`, `libraries.javascript.pull`, or
-  `libraries.python.pull`)
+  Libraries](/chainguard/libraries/access/#entitlement)
 
 Confirm that `chainctl` and `cosign` are installed and available on the `PATH`
 with the following commands:
@@ -121,6 +118,8 @@ Analyze a Python wheel file in the current directory:
 chainctl libraries verify flask-3.0.1-py3-none-any.whl
 ```
 
+> **Note**: Running `chainctl libraries verify` requires one of the `libraries.java.pull`, `libraries.javascript.pull`, or `libraries.python.pull` permissions, or the Owner role.
+
 The analysis of wheel files is fast because the provenance information is
 available within the archive. Python development tools often unpack the wheel
 file and you can also scan these extracted packages. For example, if you create