Chainloop is an open source evidence store for the software supply chain. A command line tool runs inside a GitHub Actions, GitLab, Jenkins, or Dagger pipeline, picks up what the build produced, uploads those files to content-addressable storage, and references each one in a signed in-toto attestation. in-toto is a specification for recording who ran which step of a build, so the record can be checked afterward.
Compliance and security teams get a control plane where all of it arrives, already signed, no matter which continuous integration provider produced it.
The gap that closes is easy to see in a pipeline that lacks it. A build turns out a bill of materials listing every dependency in the release, a SARIF file recording what the static analyzer found, a coverage report, a container image reference, and a scan from whatever commercial tool the security group bought last year.
Each file lands somewhere different. Nothing signed ties any of them to the commit that produced them, so when a customer asks six months later which version of a compression library shipped in a given release, someone is digging through build logs to reconstruct an answer they can’t verify.
The contract does the enforcing
A Workflow Contract declares what a build has to hand over: which materials, which build information, and the environment the workflow has to run in.
Compliance and security teams write the contract, and Chainloop checks that the crafting of artifacts and attestation meets it, so a pipeline that stops emitting a bill of materials stops satisfying the contract. Rego policies, written in the language Open Policy Agent uses, attach to those same contracts. They are evaluated automatically and their results are written into the attestation before it is signed and stored, so the verdict on a build travels inside the signed record rather than sitting in a dashboard someone can edit later.
Seventeen named evidence formats get first-class handling, and the full catalog runs longer than that. CycloneDX and SPDX bills of materials, OpenVEX, the four CSAF document types, SARIF, ZAP DAST results, BlackDuck SCA output, PrismaCloud Twistcli scans, GitLab security reports, JUnit results, JaCoCo XML coverage, Helm charts, and container image references are among them. Anything else goes in under one of four catch-all categories, as a custom evidence type, an approval report in JSON for instance, or as key-value metadata pairs.
Signing is not tied to one method either: evidence can be signed through Sigstore or through an organization’s own PKI, including AWS KMS or Keyfactor, which matters to anyone whose keys have to stay in-house.
Two audiences, one integration point
Artifacts and evidence can be routed to an OCI registry or cloud blob storage, sent to Dependency-Track or Guac for bill-of-materials analysis, and announced in Jira, Discord, or Slack. Swapping the analysis backend requires no change to a pipeline, because the pipeline only ever talks to the crafting tool.
Compliance and security teams define the contracts, craft the policies, wire up those integrations, and hold access to the control plane. Development teams get a different pitch.
What the regulations require
FedRamp, Executive Order 14028 in the United States, the EU Cyber Resilience Act, and the Digital Operational Resilience Act all turn questions about what shipped into questions someone has to answer on a deadline. The project publishes guides for the Cyber Resilience Act and for SLSA, the supply chain framework whose level 3 the single source of truth is built to satisfy. A FedRamp guide is listed as coming.
The command line tool points at a hosted Chainloop instance by default, which is convenient for a trial and means the evidence leaves your infrastructure. Running the Helm chart on your own Kubernetes cluster puts the control plane back in-house.
Chainloop is available for free on GitHub.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!