Chainloop Open‑Source Evidence Store Brings Signed Build Artifacts to the Software Supply Chain
What Happened — Chainloop, an open‑source project, adds a command‑line tool that runs inside CI pipelines (GitHub Actions, GitLab, Jenkins, Dagger) to capture build outputs, store them in content‑addressable storage, and attach each artifact to a signed in‑toto attestation. The system also enforces “Workflow Contracts” written in Rego, automatically evaluating policy compliance before the attestation is sealed.
Why It Matters for Compliance & Audit Readiness
- Provides immutable, signed evidence of every build step, satisfying SOC 2 CC6 (System Operations) and CC7 (Change Management) requirements for verifiable change logs.
- Automates continuous collection of artifacts (SBOM, SARIF, coverage, container images) that can be presented as audit evidence without manual reconstruction.
- Enables policy‑as‑code enforcement (OPA/Rego) directly in the pipeline, giving auditors a defensible trail that the build met pre‑approved security contracts.
Who Is Affected — Software vendors, SaaS providers, DevSecOps teams, and any organization that ships code through CI/CD pipelines.
Recommended Actions
- Map the Chainloop evidence types (SBOM, SARIF, container image digests, etc.) to the relevant SOC 2 controls in your compliance framework.
- Integrate the tool into your CI/CD workflow and configure signed attestations using your organization’s PKI or Sigstore.
- Capture the generated attestations as part of your continuous‑compliance evidence repository for audit readiness.
Source: Help Net Security – Chainloop Open‑Source Supply‑Chain Security
Technical Notes – Chainloop leverages the in‑toto specification for provenance, supports 17 native evidence formats (CycloneDX, SPDX, OpenVEX, CSAF, SARIF, etc.), and can sign artifacts via Sigstore, AWS KMS, or on‑prem PKI. No CVEs or vulnerabilities are disclosed. Source: same as above