[opensourcedex]

chainloop is a free, open source compliance & risk management project written in Go and released under Apache-2.0. It has 610 GitHub stars, 64 forks and 17 open issues, and was last pushed 8 hours ago. On this registry it ranks #53 of 56 tracked projects in Compliance & Risk Management, with 5 head-to-head comparisons available. It gained 28 stars over the last 30 tracked days.

What is chainloop?

Chainloop is an open-source evidence store and policy engine for software supply chain attestations, SBOMs, VEX, SARIF and QA reports, built for security, compliance and risk teams in regulated industries and for the developers who must supply that evidence from CI/CD pipelines.

What it is

Chainloop is a Go project under Apache-2.0 that acts as an evidence store plus a policy engine for the software supply chain. Security, compliance and risk management teams use it to define security and compliance policies, to declare what evidence and artifacts they want to receive, and to choose where that material is stored. It keeps a single source of truth for attestation metadata and artifacts, described as SLSA level 3 compliant and built on open standards including Sigstore, in-toto, SLSA and OCI. It sits in the DevSecOps and supply chain compliance ecosystem, and its public topics — attestation, compliance, cyclonedx, in-toto, sbom, devsecops, ospo, oss-compliance, regulated-industry, license — show the audience it targets.

The concrete problem it solves is fragmentation between the people who must prove compliance and the people who run builds. Without a shared mechanism, each CI/CD provider needs its own point integration, evidence lands in different places, signing and retention are inconsistent, and developers absorb the complexity. Chainloop replaces those per-provider point integrations with one integration point, and replaces informal, bespoke requests for build metadata with declarative Workflow Contracts that state what data (build info, materials) must arrive in the attestation and in which environment the workflow must run.

Key capabilities

  • Workflow Contracts declare, per workflow, what evidence and materials must be received and where the workflow may execute.
  • Policy as code: compliance and security teams write Rego policies and attach them to contracts; policies are evaluated automatically and results are added to the attestation before signing and storage.
  • Attestation crafting and storage through a single integration point regardless of which CI/CD provider is in use.
  • A SLSA level 3 compliant source of truth for metadata, artifacts and attestations, built on Sigstore, in-toto, SLSA and OCI.
  • Ingestion of SBOMs, VEX, SARIF reports, QA reports and build metadata alongside attestations.
  • Third-party integrations such as Dependency-Track and GUAC for SBOM analysis, plus storage backends such as an OCI registry or cloud blob storage.
  • Role-tailored experience: separate views and controls for operators, compliance and security teams, and developers.

Who uses it and how

  • Security, compliance and risk teams in regulated industries define the policies, evidence types and storage destinations, then enforce them downstream across the organization.
  • Platform and operator teams wire up integrations — Dependency-Track or GUAC for SBOM analysis, and an OCI registry or cloud blob storage as the artifact and evidence backend — without asking developers to change anything on their side.
  • DevSecOps and CI/CD engineers instrument pipelines so they emit the artifacts and attestation metadata the contract requires, receiving plain instructions on what to provide.
  • OSPO and open-source compliance functions use the license and oss-compliance coverage to track what ships inside builds.
  • Organizations that need signed, retained attestation evidence tied to a specific contract rather than ad-hoc per-pipeline output.

Getting started

The README directs readers to the documentation at https://docs.chainloop.dev, which covers integrations and the available deployment paths. The project's own repository is the source of truth for installation, and its integrations page lists the supported backends and third-party systems.

How it compares

No list of paid products replaced by Chainloop is provided in the facts, and no directly comparable project is named. The named tools are standards and integrations it builds on or feeds — Sigstore, in-toto, SLSA, OCI, Open Policy Agent, Dependency-Track and GUAC — rather than alternatives. On the evidence given, it stands alone in this registry.

When to use it — and when not

A self-hoster must operate the Chainloop control plane plus the surrounding pieces the README describes: a storage backend such as an OCI registry or cloud blob storage, and signing via Sigstore with the in-toto/SLSA attestation formats. Teams with no compliance obligation to prove, or with a single pipeline and no evidence-retention requirement, gain little from adopting a policy engine and evidence store. The provided README excerpt is also truncated mid-sentence and does not document the install or run method directly, so plan to rely on https://docs.chainloop.dev and to check the project's current release and issue activity before committing.

project readme (upstream, from github) — read inline

Chainloop

LFX Health Score OpenSSF Scorecard Test passing Chat on Slack License: Apache-2.0

What is it?

Chainloop is an open-source evidence store for your Software Supply Chain attestations, Software Bill of Materials (SBOMs), VEX, SARIF, QA reports, and more. With Chainloop, Security, Compliance, and Risk management teams can define security and compliance policies, what evidence and artifacts they want to receive, and where to store them. On the other hand, developers are shielded from all this complexity by being given simple instructions on what to provide when instrumenting their CI/CD pipelines.

To learn more about the project motivation please look at our documentation.

How does it work?

Compliant Single Source of Truth

Craft and store attestation metadata and artifacts via a single integration point regardless of your CI/CD provider choice.

Chainloop Overview

The result is having a SLSA level 3 compliant single Source of truth for metadata, artifacts and attestations built on OSS standards such as Sigstore, in-toto, SLSA and OCI.

Chainloop also makes sure the crafting of artifacts and attestation follows best practices and meets the requirements declared in their associated Workflow Contract.

Declarative, contract-based attestation

One key aspect is that in Chainloop, CI/CD integrations are declared via Workflow Contracts.

A Workflow Contract gives Compliance and Security teams full control over what kind of data (build info, materials) must be received as part of the attestation and the environment where these workflows must be executed at. This enables an easy, and maintainable, way of propagating and enforcing requirements downstream to your organization.

You can think of it as an API for your organization's Software Supply Chain that both parties, development and Compliance and Security teams can use to interact effectively.

Chainloop Contracts

Policy as code

Compliance and Security teams can craft Rego policies, and attach them to workflow contracts. Those policies will be automatically evaluated, and their results will be added to the attestation before signing and storage.

We meet you where you are with third-party integrations

Operators can set up third-party integrations such as Dependency-Track, or Guac for SBOM analysis or a storage backend such as an OCI registry, or cloud blob storage to place the received artifacts, pieces of evidence and attestation metadata.

Chainloop Overview

Compliance and Security teams can mix and match with different integrations while not requiring developers to make any changes on their side!

To learn more and to find the list of available integrations, check our integrations page.

Role-tailored experience

Chainloop makes sure to clearly define the responsibilities, experience and functional scope of the two main personas, Compliance/Security and Development teams.

Compliance and Security teams are the ones in charge of defining the Workflow Contracts, crafting policies, setting up third-party integrations, or having access to the control plane where all the Software Supply Chain Security bells and whistles are exposed.

Development teams on the other hand, just need to integrate Chainloop's jargon-free crafting tool and follow the steps via a familiar DevExp to make sure they comply with the Workflow Contract defined by the SecOps team. No need to learn in-toto, signing, SLSA, OCI, APIs, nada :)

Supported Pieces of Evidence / Materials

During the attestation process, you can attach different pieces of evidence and artifacts that will get uploaded to the Content Addressable Storage (if applicable) and referenced in a signed in-toto attestation.

Chainloop supports the collection of the following list of evidence types. For the full list please refer to this page

Getting started

Follow the quickstart or the getting started guide for detailed information on a) how to download and configure the Chainloop CLI and b) how to deploy Chainloop on your Kubernetes Cluster.

Command Line Interface (CLI) installation

Alternatively, you can download the CLI from the releases pages or build it from source.

To install the latest version for macOS, Linux or Windows (using WSL) just choose one of the following installation methods.

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --oss

To install the enterprise edition instead, omit the --oss flag.

you can retrieve a specific version with

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --oss --version v1.7.0

and customize the install path (default to /usr/local/bin)

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --oss --path /my-path

if cosign is present in your system, in addition to the checksum check, a signature verification will be performed. This behavior can be enforced via the --force-verification flag.

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --oss --force-verification

Deploy Chainloop (optional)

Downloading the CLI is everything you need to give Chainloop a try, since, by default, it points to a running instance of Chainloop.

You can also run your own Chainloop instance on your Kubernetes cluster by leveraging this Helm Chart.

Configure CLI (optional)

If you are running your own instance of the Control Plane. You can make the CLI point to your instance by using the chainloop config save command.

chainloop config save \
  --control-plane my-controlplane.acme.com \
  --artifact-cas cas.acme.com

Authentication

Authenticate to the Control Plane by running

$ chainloop auth login

Finishing the setup

Once you've been logged in, follow these instructions to learn how to set up your account.

Documentation

To learn more, please visit the Chainloop project's documentation website, https://docs.chainloop.dev where you will find a getting started guide, FAQ, examples, and more.

Community / Discussion / Support

Chainloop is developed in the open and is constantly improved by our users, contributors and maintainers. Got a question, comment, or idea? Please don't hesitate to reach out via:

Contributing

Want to get involved? Contributions are welcome.

If you are ready to jump in and test, add code, or help with documentation, please follow the instructions on our Contribution page. At all times, follow our Code of Conduct.

See the issue tracker if you're unsure where to start, especially the Good first issue label.

Changelog

Take a look at the list of releases to stay tuned for the latest features and changes.

License

Chainloop is released under the Apache License, Version 2.0. Please see the LICENSE file for more information.

Frequently asked questions

Is chainloop free to use?

chainloop is open source under the Apache-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does chainloop do?

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

What is chainloop written in?

chainloop is primarily written in Go. Its source is publicly available at https://github.com/chainloop-dev/chainloop, and it has 610 GitHub stars.