Chainloop is an open-source evidence store and policy engine designed to secure the software supply chain by providing a verifiable record of build artifacts and processes. The system aims to address the challenge of tracking and verifying diverse build outputs, such as software bills of materials (SBOMs), static analysis reports, and container images, which often land in disparate locations without cryptographic links to their originating commits.
The core of Chainloop is a command-line interface (CLI) tool that integrates into continuous integration (CI) pipelines, including GitHub Actions, GitLab, Jenkins, and Dagger. This tool captures build outputs, uploads them to content-addressable storage, and references them within a signed in-toto attestation. In-toto is a specification that records details about who executed each step of a build, enabling subsequent verification of the process.
Compliance and security teams utilize a control plane where all signed attestations and artifacts are collected, regardless of the CI provider. The system enforces "Workflow Contracts," which are declarations defining the required materials, build information, and execution environment for a build. These contracts are authored by security and compliance teams, and Chainloop verifies that artifact creation and attestations adhere to them. Failure to produce a required artifact, such as an SBOM, would result in a contract violation.
Further enhancing policy enforcement, Rego policies, written in the Open Policy Agent language, can be attached to these contracts. These policies are automatically evaluated, and their results are embedded within the attestation before it is signed and stored. This ensures that the verdict on a build's compliance travels with the signed record, preventing later tampering with dashboard-based assessments.
Chainloop offers first-class handling for seventeen named evidence formats, with a broader catalog of supported types. These include CycloneDX and SPDX SBOMs, OpenVEX, four CSAF document types, SARIF, ZAP DAST results, BlackDuck SCA output, PrismaCloud Twistcli scans, GitLab security reports, JUnit results, JaCoCo XML coverage, Helm charts, and container image references. Custom evidence types, such as JSON approval reports, and key-value metadata pairs can also be incorporated.
The system supports flexible signing methods, allowing evidence to be signed via Sigstore or an organization's internal Public Key Infrastructure (PKI), including services like AWS KMS or Keyfactor, which is crucial for organizations with strict key management requirements.
Artifacts and evidence can be routed to OCI registries or cloud blob storage. For analysis, they can be sent to tools like Dependency-Track or Guac for SBOM analysis. Notifications can be integrated with platforms such as Jira, Discord, or Slack. The design ensures that changing the analysis backend does not require modifications to the CI pipeline, as the pipeline only interacts with the crafting tool.
Chainloop is designed to help organizations meet regulatory requirements from frameworks such as FedRamp, the U.S. Executive Order 14028, the EU Cyber Resilience Act, and the Digital Operational Resilience Act. The project provides guides for the Cyber Resilience Act and for SLSA (Supply-chain Levels for Software Artifacts), aiming to satisfy SLSA Level 3 by establishing a single source of truth for build information. A FedRamp guide is also planned.
While the CLI tool defaults to pointing at a hosted Chainloop instance, which sends evidence outside the user's infrastructure, organizations can deploy Chainloop on their own Kubernetes clusters using a Helm chart to keep the control plane in-house. Chainloop is freely available on GitHub.
