Chainloop Emerges as Open-Source Tool for Software Supply Chain Security
Chainloop, a new open-source project, provides an evidence store and policy engine to enhance security and compliance within software development pipelines.
Chainloop is a newly released open-source tool designed to bolster the security of the software supply chain. It functions as an evidence store, meticulously collecting build artifacts and generating signed in-toto attestations. This capability empowers compliance and security teams to rigorously verify the integrity and provenance of software builds directly within their continuous integration and continuous delivery (CI/CD) pipelines, including popular platforms like GitHub Actions and GitLab.
The tool operates via a command-line interface that integrates seamlessly into CI/CD workflows such as GitHub Actions, GitLab, Jenkins, or Dagger. Once integrated, it captures the outputs of a build process, uploads these files to content-addressable storage, and then creates a reference to each file within a signed in-toto attestation. The in-toto specification is crucial here, as it provides a standardized method for recording the steps taken during a build, ensuring that these records can be reliably audited and verified post-completion.
This addresses a significant gap in current development practices where disparate build artifacts often lack a unified, verifiable link to their origin. Without such a system, reconstructing the exact dependencies or components used in a specific release can become a time-consuming and unreliable process, especially when queried months later by customers or auditors. Chainloop aims to eliminate this ambiguity by ensuring that all critical build information is signed and tied to its source.
A core feature of Chainloop is its Workflow Contract mechanism. This contract defines the expected outputs of a build, including specific materials, build information, and the required execution environment. Chainloop enforces these contracts, ensuring that pipelines consistently produce the necessary artifacts and attestations. Furthermore, it integrates policy enforcement through Rego policies, written in the language of Open Policy Agent. These policies are evaluated automatically, and their results are embedded directly into the signed attestation, providing an immutable record of compliance checks.
Chainloop offers first-class support for a wide array of evidence formats, including popular standards like CycloneDX and SPDX for bills of materials, OpenVEX for vulnerability information, CSAF for security advisories, SARIF for static analysis results, and various security scan outputs from tools like BlackDuck and PrismaCloud. For formats not explicitly supported, Chainloop provides flexible catch-all categories for custom evidence types or key-value metadata.
Signing flexibility is another key aspect, with Chainloop supporting multiple signing methods. Organizations can leverage Sigstore for signing or integrate their existing Public Key Infrastructure (PKI), including options like AWS KMS or Keyfactor, accommodating diverse security requirements and key management policies.
The system is designed with two primary audiences in mind: compliance and security teams, and development teams. While compliance and security professionals manage the contracts, policies, and integrations through a central control plane, developers benefit from a streamlined process that integrates security checks directly into their existing workflows without significant disruption.
Chainloop's release comes at a time when regulatory pressures are mounting globally. Regulations such as FedRamp in the US, the EU Cyber Resilience Act, and the Digital Operational Resilience Act (DORA) increasingly demand verifiable answers about software composition and security. Chainloop provides a practical solution to meet these evolving compliance demands, with guides available for frameworks like SLSA and upcoming support for FedRamp.