An open-source evidence store collects and signs software supply-chain records from CI pipelines, helping security and compliance teams verify build information and enforce workflow policies.
Chainloop is an open-source evidence store for software supply chains. Its command-line tool runs within CI pipelines such as GitHub Actions, GitLab, Jenkins, and Dagger, collects build outputs, uploads them to content-addressable storage, and references each file in a signed in-toto attestation. This provides security and compliance teams with a central control plane containing signed evidence regardless of the CI provider.
The standard build operation can generate software bill-of-materials (SBOMs), SARIF files, coverage reports, container images and security scans, which are otherwise maintained independently without being tied to the commit that generated the files. Chainloop solves this problem by tying the evidence to the build through attestations. The Workflow Contract defines the materials, build information and environment that a particular workflow should provide. Rego policies can also be attached to these contracts, whose evaluation results are then added to the attestation before it is signed and stored.
The Chainloop platform provides first-class support for 17 distinct types of evidence, including SBOMs (CycloneDX, SPDX), OpenVEX, CSAF, SARIF, ZAP DAST Scan Result, BlackDuck SCA Result, PrismaCloud Twistcli Scan Result, Gitlab Security Report, JUnit Result, JaCoCo XML Coverage, Helm Chart, Container Image References. Other data can be included in the evidence as per custom evidence type, JSON Approval Reports, or as key-value pairs. Evidence signing can happen either via Sigstore or your own PKI, including AWS KMS and Keyfactor.
For storage and integration, Chainloop can route artefacts and evidence to OCI registries or cloud blob storage, while integration with Dependency-Track and Guac provides bill-of-materials analysis. Notifications can also be issued to Jira, Discord, or Slack. The pipeline connects with the Chainloop crafting tool, allowing the analysis backend to be changed independently of the pipeline.
Beyond evidence management, Chainloop also covers the software supply chain compliance requirements related to FedRAMP, Executive Order 14028, the EU Cyber Resilience Act, and the Digital Operational Resilience Act. It provides guidance on the Cyber Resilience Act and SLSA, while a FedRAMP guide is planned. The CLI tool connects to a hosted Chainloop instance by default, although organisations can deploy the control plane on their Kubernetes cluster using the Helm chart. Chainloop is available as free software on Github.
