[opensourcedex]

chainloop is a free, open source compliance & risk management project written in Go and released under Apache-2.0. It has 582 GitHub stars, 57 forks and 17 open issues, and was last pushed 16 hours ago. On this registry it ranks #49 of 52 tracked projects in Compliance & Risk Management, with 5 head-to-head comparisons available.

Chainloop

LFX Health Score OpenSSF Scorecard Test passing Chat on Slack License: Apache-2.0

What is it?

Chainloop is an open-source evidence store for your Software Supply Chain attestations, Software Bill of Materials (SBOMs), VEX, SARIF, QA reports, and more. With Chainloop, Security, Compliance, and Risk management teams can define security and compliance policies, what evidence and artifacts they want to receive, and where to store them. On the other hand, developers are shielded from all this complexity by being given simple instructions on what to provide when instrumenting their CI/CD pipelines.

To learn more about the project motivation please look at our documentation.

How does it work?

Compliant Single Source of Truth

Craft and store attestation metadata and artifacts via a single integration point regardless of your CI/CD provider choice.

Chainloop Overview

The result is having a SLSA level 3 compliant single Source of truth for metadata, artifacts and attestations built on OSS standards such as Sigstore, in-toto, SLSA and OCI.

Chainloop also makes sure the crafting of artifacts and attestation follows best practices and meets the requirements declared in their associated Workflow Contract.

Declarative, contract-based attestation

One key aspect is that in Chainloop, CI/CD integrations are declared via Workflow Contracts.

A Workflow Contract gives Compliance and Security teams full control over what kind of data (build info, materials) must be received as part of the attestation and the environment where these workflows must be executed at. This enables an easy, and maintainable, way of propagating and enforcing requirements downstream to your organization.

You can think of it as an API for your organization's Software Supply Chain that both parties, development and Compliance and Security teams can use to interact effectively.

Chainloop Contracts

Policy as code

Compliance and Security teams can craft Rego policies, and attach them to workflow contracts. Those policies will be automatically evaluated, and their results will be added to the attestation before signing and storage.

We meet you where you are with third-party integrations

Operators can set up third-party integrations such as Dependency-Track, or Guac for SBOM analysis or a storage backend such as an OCI registry, or cloud blob storage to place the received artifacts, pieces of evidence and attestation metadata.

Chainloop Overview

Compliance and Security teams can mix and match with different integrations while not requiring developers to make any changes on their side!

To learn more and to find the list of available integrations, check our integrations page.

Role-tailored experience

Chainloop makes sure to clearly define the responsibilities, experience and functional scope of the two main personas, Compliance/Security and Development teams.

Compliance and Security teams are the ones in charge of defining the Workflow Contracts, crafting policies, setting up third-party integrations, or having access to the control plane where all the Software Supply Chain Security bells and whistles are exposed.

Development teams on the other hand, just need to integrate Chainloop's jargon-free crafting tool and follow the steps via a familiar DevExp to make sure they comply with the Workflow Contract defined by the SecOps team. No need to learn in-toto, signing, SLSA, OCI, APIs, nada :)

Supported Pieces of Evidence / Materials

During the attestation process, you can attach different pieces of evidence and artifacts that will get uploaded to the Content Addressable Storage (if applicable) and referenced in a signed in-toto attestation.

Chainloop supports the collection of the following list of evidence types. For the full list please refer to this page

readme truncated — read the full docs on github

Frequently asked questions

Is chainloop free to use?

chainloop is open source under the Apache-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does chainloop do?

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

What is chainloop written in?

chainloop is primarily written in Go. Its source is publicly available at https://github.com/chainloop-dev/chainloop, and it has 582 GitHub stars.