{
  "markdown": "# Chainloop\n\n[![LFX Health Score](https://insights.linuxfoundation.org/api/badge/health-score?project=chainloop)](https://insights.linuxfoundation.org/project/chainloop)\n[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/chainloop-dev/chainloop/badge)](https://securityscorecards.dev/viewer/?uri=github.com/chainloop-dev/chainloop)\n![Test passing](https://github.com/chainloop-dev/chainloop/actions/workflows/test.yml/badge.svg?branch=main)\n[![Chat on Slack](https://img.shields.io/badge/slack-chainloop-blue?logo=slack)](https://join.slack.com/t/chainloop-community/shared_invite/zt-2k34dvx3r-u85uGP_KiLC6ic5Wy4aRnQ)\n[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://github.com/chainloop-dev/chainloop/blob/main/LICENSE.md)\n\n## What is it?\n\n[Chainloop](https://github.com/chainloop-dev/chainloop) is an open-source evidence store for your Software Supply Chain attestations, Software Bill of Materials (SBOMs), VEX, SARIF, QA reports, and more. With Chainloop, Security, Compliance, and Risk management teams can define security and compliance policies, what evidence and artifacts they want to receive, and where to store them. On the other hand, developers are shielded from all this complexity by being given simple instructions on what to provide when instrumenting their CI/CD pipelines.\n\nTo learn more about the project motivation please look at [our documentation](https://docs.chainloop.dev).\n\n## How does it work?\n\n### Compliant Single Source of Truth\n\nCraft and store attestation metadata and artifacts via a single integration point regardless of your CI/CD provider choice.\n\n![Chainloop Overview](./docs/img/overview-1.png)\n\nThe result is having a SLSA level 3 compliant single Source of truth for metadata, artifacts and attestations built on OSS standards such as [Sigstore](https://www.sigstore.dev/), [in-toto](https://in-toto.io/), [SLSA](https://slsa.dev) and [OCI](https://github.com/opencontainers/image-spec/blob/main/spec.md).\n\nChainloop also makes sure the crafting of artifacts and attestation follows **best practices and meets the requirements** declared in their associated Workflow Contract.\n\n### Declarative, contract-based attestation\n\nOne key aspect is that in Chainloop, CI/CD integrations are declared via [**Workflow Contracts**](https://docs.chainloop.dev/concepts/contracts).\n\nA Workflow Contract gives Compliance and Security teams **full control over what kind of data (build info, materials) must be received as part of the attestation and the environment where these workflows must be executed at**. This enables an easy, and maintainable, way of propagating and enforcing requirements downstream to your organization.\n\nYou can think of it as an **API for your organization's Software Supply Chain** that both parties, development and Compliance and Security teams can use to interact effectively.\n\n![Chainloop Contracts](./docs/img/overview-3.png)\n\n### Policy as code\n\nCompliance and Security teams can [craft](https://docs.chainloop.dev/guides/custom-policies) [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/) policies, and [attach](https://docs.chainloop.dev/concepts/policies) them to workflow contracts. Those policies will be automatically evaluated, and their results will be added to the attestation before signing and storage.\n\n\n### We meet you where you are with third-party integrations\n\nOperators can set up third-party integrations such as [Dependency-Track](https://docs.chainloop.dev/guides/dependency-track), or [Guac](https://github.com/chainloop-dev/chainloop/blob/main/app/controlplane/plugins/core/guac/v1/README.md) for SBOM analysis or a storage backend such as an OCI registry, or cloud blob storage to place the received artifacts, pieces of evidence and attestation metadata.\n\n![Chainloop Overview](./docs/img/overview-2.png)\n\nCompliance and Security teams can mix and match with different integrations while **not requiring developers to make any changes on their side**!\n\nTo learn more and to find the list of available integrations, check our [integrations page](./devel/integrations.md).\n\n### Role-tailored experience\n\nChainloop makes sure to clearly define the responsibilities, experience and functional scope of the **two main personas, Compliance/Security and Development teams**.\n\nCompliance and Security teams are the ones in charge of defining the Workflow Contracts, crafting policies, setting up third-party integrations, or having access to the control plane where all the Software Supply Chain Security bells and whistles are exposed.\n\nDevelopment teams on the other hand, just need to integrate Chainloop's jargon-free [crafting tool](https://docs.chainloop.dev/concepts/attestations#attestation-lifecycle) and follow the steps via a familiar DevExp to make sure they comply with the Workflow Contract defined by the SecOps team. No need to learn in-toto, signing, SLSA, OCI, APIs, nada :)\n\n## Supported Pieces of Evidence / Materials\n\nDuring the attestation process, you can attach different pieces of evidence and artifacts that will get uploaded to the [Content Addressable Storage](https://docs.chainloop.dev/concepts/cas-backend) (if applicable) and referenced in a signed in-toto attestation.\n\nChainloop supports the collection of the following list of evidence types. For the full list please refer to [this page](https://docs.chainloop.dev/concepts/material-types)\n\n- Key-Value metadata pairs\n- [Container Image Reference](https://github.com/opencontainers/image-spec)\n- Artifact Type: It represents a software artifact.\n- [CycloneDX SBOM](https://github.com/CycloneDX/specification)\n- [SPDX SBOM](https://spdx.dev/specifications/)\n- [JUnit](https://www.ibm.com/docs/en/developer-for-zos/14.1?topic=formats-junit-xml-format)\n- [OpenVEX](https://github.com/openvex)\n- [CSAF VEX](https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#45-profile-5-vex)\n- [SARIF](https://docs.oasis-open.org/sarif/sarif/v2.1.0/)\n- [Helm Chart](https://helm.sh/docs/topics/charts/)\n- Custom Evidence Type: Custom piece of evidence that doesn't fit in any other category, for instance, an approval report in json format, etc.\n- Attestation: existing Chainloop attestations.\n- [CSAF Informational Advisory](https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#43-profile-3-informational-advisory)\n- [CSAF Security Advisory](https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#44-profile-4-security-advisory)\n- [CSAF Security Incident Report](https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#42-profile-2-security-incident-response)\n- [Gitlab Security report](https://docs.gitlab.com/ee/user/application_security/)\n- [ZAP DAST](https://github.com/marketplace/actions/zap-baseline-scan)\n- [BlackDuck SCA](https://www.blackduck.com/software-composition-analysis-tools/black-duck-sca.html)\n- [PrismaCloud Twistcli Scan](https://docs.prismacloud.io/en/compute-edition/30/admin-guide/tools/twistcli-scan-images)\n- [GitHub Advanced Security Code Scan](https://docs.github.com/en/rest/code-scanning/code-scanning?apiVersion=2022-11-28)\n- [GitHub Advanced Security Secret Scan](https://docs.github.com/en/rest/secret-scanning/secret-scanning?apiVersion=2022-11-28)\n- [GitHub Advanced Security Dependency Scan](https://docs.github.com/en/rest/dependabot/alerts?apiVersion=2022-11-28)\n- [JaCoCo XML Coverage Reports](https://www.jacoco.org/jacoco/trunk/doc/)\n- [SLSA Provenance files](https://slsa.dev/spec/v1.1/provenance)\n- Chainloop Runner Context: automatically collected runner metadata.\n- Chainloop Pull Request Info: pull/merge request metadata collected automatically during attestation.\n- [Gitleaks JSON Report](https://github.com/gitleaks/gitleaks/blob/master/README.md#reporting)\n- Chainloop AI Agent Config: AI agent configuration collected automatically during attestation.\n- Chainloop AI Coding Session: AI coding session telemetry collected during attestation.\n- [OpenAPI Specification](https://spec.openapis.org/oas/latest.html)\n- [AsyncAPI Specification](https://www.asyncapi.com/docs/reference/specification/latest)\n- [GraphQL SDL Schema](https://spec.graphql.org/)\n- [detect-secrets Baseline](https://github.com/Yelp/detect-secrets)\n- [Sysinternals Sigcheck (CSV)](https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck)\n- [Sysinternals AccessChk (text)](https://learn.microsoft.com/en-us/sysinternals/downloads/accesschk)\n- [CERT/CC dranzer Report](https://github.com/CERTCC/dranzer)\n- [OpenSSF Scorecard (JSON)](https://github.com/ossf/scorecard)\n- [radamsa Metadata Log](https://gitlab.com/akihe/radamsa)\n- radamsa Crashing Inputs: a single file or a `crashes/` archive (tar.gz or zip).\n- [TruffleHog JSONL Report](https://github.com/trufflesecurity/trufflehog)\n- [Cobertura Coverage Report (XML)](https://github.com/cobertura/cobertura)\n- [Checkmarx One JSON Report](https://github.com/Checkmarx/ast-cli/blob/main/internal/wrappers/results-json.go)\n- [Oversecured JSON Report](https://docs.oversecured.com/docs/guide-exporting-reports)\n- [PIT Mutation Testing XML Report](https://pitest.org/)\n\n## Getting started\n\nFollow the [quickstart](https://docs.chainloop.dev/quickstart) or the [getting started guide](https://docs.chainloop.dev/get-started) for detailed information on a) how to download and configure the Chainloop CLI and b) how to deploy Chainloop on your Kubernetes Cluster.\n\n### Command Line Interface (CLI) installation\n\n> Alternatively, you can download the CLI from the [releases pages](https://github.com/chainloop-dev/chainloop/releases) or [build it from source](./CONTRIBUTING.md).\n\nTo **install the latest version** for macOS, Linux or Windows (using [WSL](https://learn.microsoft.com/en-us/windows/wsl/install)) just choose one of the following installation methods.\n\n```bash\ncurl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --oss\n```\n\n> To install the **enterprise edition** instead, omit the `--oss` flag.\n\nyou can retrieve a specific version with\n\n```bash\ncurl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --oss --version v1.7.0\n```\n\nand customize the install path (default to /usr/local/bin)\n\n```bash\ncurl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --oss --path /my-path\n```\n\nif [`cosign`](https://docs.sigstore.dev/cosign) is present in your system, in addition to the checksum check, a signature verification will be performed. This behavior can be enforced via the `--force-verification` flag.\n\n```bash\ncurl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --oss --force-verification\n```\n\n### Deploy Chainloop (optional)\n\nDownloading the CLI is everything you need to give Chainloop a try, since, by default, it points to a [running instance of Chainloop](https://app.chainloop.dev).\n\nYou can also **run your own Chainloop instance** on your Kubernetes cluster by leveraging [this Helm Chart](./deployment/chainloop/).\n\n### Configure CLI (optional)\n\nIf you are running your [own instance](https://github.com/chainloop-dev/chainloop) of the Control Plane. You can make the CLI point to your instance by using the `chainloop config save` command.\n\n```sh\nchainloop config save \\\n  --control-plane my-controlplane.acme.com \\\n  --artifact-cas cas.acme.com\n```\n\n### Authentication\n\nAuthenticate to the Control Plane by running\n\n```bash\n$ chainloop auth login\n```\n\n### Finishing the setup\n\nOnce you've been logged in, follow [these instructions](https://docs.chainloop.dev/get-started/setup) to learn how to set up your account.\n## Documentation\n\nTo learn more, please visit the Chainloop project's documentation website, https://docs.chainloop.dev where you will find a getting started guide, FAQ, examples, and more.\n\n## Community / Discussion / Support\n\nChainloop is developed in the open and is constantly improved by our users, contributors and maintainers. Got a question, comment, or idea? Please don't hesitate to reach out via:\n\n- GitHub [Issues](https://github.com/chainloop-dev/chainloop/issues)\n- [Slack](https://join.slack.com/t/chainloop-community/shared_invite/zt-2k34dvx3r-u85uGP_KiLC6ic5Wy4aRnQ)\n- Youtube [Channel](https://www.youtube.com/channel/UCISrWrPyR_AFjIQYmxAyKdg)\n\n## Contributing\n\nWant to get involved? Contributions are welcome.\n\nIf you are ready to jump in and test, add code, or help with documentation, please follow the instructions on\nour [Contribution](CONTRIBUTING.md) page. At all times, follow our [Code of Conduct](./CODE_OF_CONDUCT.md).\n\nSee the [issue tracker](https://github.com/chainloop-dev/chainloop/issues) if you're unsure where to start, especially the [Good first issue](https://github.com/chainloop-dev/chainloop/labels/good%20first%20issue) label.\n\n## Changelog\n\nTake a look at the list of [releases](http://github.com/chainloop-dev/chainloop/releases) to stay tuned for the latest features and changes.\n\n## License\n\nChainloop is released under the Apache License, Version 2.0. Please see the [LICENSE](./LICENSE.md) file for more information.\n",
  "bytes": 12994,
  "sha": "7ffd60ac87b59c1691e2c7108e000ab22fecdb1399beb4ad54899fb77e7f477c",
  "repo_slug": "chainloop-dev/chainloop",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/skl_chainloop_dev_chainloop_devops_upgrading_887b54e9/readme"
}