An open-source tool called Chainloop addresses a persistent problem in software supply chains: scattered, unsigned evidence that complicates compliance checks and slows responses.
Chainloop serves as an evidence store for build pipelines. A command-line utility runs inside GitHub Actions, GitLab, Jenkins, or Dagger, collecting build outputs such as bills of materials, scan reports, coverage data, and container images. These files are uploaded to content-addressable storage and referenced in a signed in-toto attestation, which records who performed each step and when.
How it works
The tool resolves an issue familiar to teams tracing dependencies long after release. A typical build might generate a CycloneDX bill of materials, a SARIF file from a static analyzer, a coverage report, and a container image. These files often end up in separate locations—cloud storage, security dashboards, or build logs—without signatures, leaving no verifiable link to the commit that produced them. When customers ask which library version shipped in a specific release, teams must manually reconstruct answers they cannot fully trust.
Chainloop automates this process through a contract system. Compliance and security teams specify what a build must deliver—materials, build information, and environment details—and the tool verifies that the pipeline meets those requirements. If a build fails to produce a bill of materials, it violates the contract. Rego policies, written in the language used by Open Policy Agent, are evaluated automatically, with results embedded in the attestation before signing. The verdict remains part of the signed record, not stored in an editable dashboard.
Related: Most production activity comes from non humans
Seventeen evidence formats receive built-in support, including CycloneDX and SPDX bills of materials, OpenVEX, CSAF documents, SARIF, ZAP DAST results, BlackDuck SCA output, PrismaCloud Twistcli scans, GitLab security reports, JUnit results, JaCoCo XML coverage, Helm charts, and container image references. Other data can be stored as custom evidence types, approval reports in JSON, or key-value metadata pairs.
Signing methods are flexible. Evidence can be signed using Sigstore or an organization’s public key infrastructure, including AWS KMS or Keyfactor. This adaptability helps teams whose keys must remain on-premises.
Who uses it—and why
Chainloop targets two groups: compliance and security teams, and development teams. The first group defines contracts, writes policies, and sets up integrations with tools like Dependency-Track or Guac for bill-of-materials analysis. They also configure alerts in Jira, Discord, or Slack. The pipeline communicates only with Chainloop’s crafting tool, so changing analysis backends does not require build process modifications.
Developers benefit from fewer compliance disruptions. Regulations such as FedRAMP, U.S. Executive Order 14028, the EU Cyber Resilience Act, and the Digital Operational Resilience Act turn questions about shipped components into urgent deadlines. Chainloop provides guides for the Cyber Resilience Act and SLSA, the supply chain framework it supports. A FedRAMP guide is planned.
Related: AI safety tests fail to stop secret leaks
Most teams begin with the hosted version, which stores evidence outside their infrastructure. For those needing on-premises control, Chainloop offers a Helm chart to deploy the control plane on Kubernetes. The tool is available for free on GitHub.
Such systems are not merely about reducing paperwork. When a vulnerability emerges, having a signed, verifiable record can mean the difference between a quick fix and a prolonged incident. Regulatory pressures and customer demands for transparency continue to grow, increasing the need for reliable evidence.
The default configuration sends evidence to an OCI registry or cloud blob storage, though teams can redirect it to other tools without altering the pipeline. This separation allows security teams to enforce policies without slowing builds, while developers retain their existing workflows.
Chainloop’s method stands out by treating the entire evidence chain as a priority. Most tools focus on individual components—bills of materials, scan results, or signing—leaving the rest to manual processes. By integrating the pipeline into a single, verifiable system, it reduces uncertainty in software supply chain security.
