You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+69-70Lines changed: 69 additions & 70 deletions
Original file line number
Diff line number
Diff line change
@@ -11,74 +11,10 @@
11
11
12
12
## What is it?
13
13
14
-
Chainloop is an open-source Software Supply Chain control plane, a single source of truth for metadata and artifacts, plus a declarative attestation process.
15
-
16
-
With Chainloop, SecOps teams can declaratively state the pieces of evidence and artifact expectations for their organization’s CI/CD workflows. At the same time, they can rest assured that the metadata will reach the desired destination for storage and analysis, always meeting the latest standards and best practices.
17
-
18
-
On the other hand, developer teams do not need to become security experts. The attestation crafting tool will guide them with guardrails and a familiar developer experience.
14
+
[Chainloop](https://github.com/chainloop-dev/chainloop) is an open-source evidence store for your Software Supply Chain attestations, Software Bill of Materials (SBOMs), VEX, SARIF, QA reports, and more. With Chainloop, Security, Compliance, and Risk management teams can define security and compliance policies, what evidence and artifacts they want to receive, and where to store them. On the other hand, developers are shielded from all this complexity by being given simple instructions on what to provide when instrumenting their CI/CD pipelines.
19
15
20
16
To learn more about the project motivation please look at [our documentation](https://docs.chainloop.dev) and see it in action in [this video](https://www.youtube.com/watch?v=GfSR2ZkZ3as).
21
17
22
-
## Getting started
23
-
24
-
See the [getting started guide](https://docs.chainloop.dev/getting-started/installation#command-line-interface-cli-installation) for detailed information on a) how to download and configure the Chainloop CLI and b) how to deploy Chainloop on your Kubernetes Cluster.
25
-
26
-
### Command Line Interface (CLI) installation
27
-
28
-
> Alternatively, you can download the CLI from the [releases pages](https://github.com/chainloop-dev/chainloop/releases) or [build it from source](./CONTRIBUTING.md).
29
-
30
-
To **install the latest version** for macOS, Linux or Windows (using [WSL](https://learn.microsoft.com/en-us/windows/wsl/install)) just choose one of the following installation methods.
if [`cosign`](https://docs.sigstore.dev/cosign) is present in your system, in addition to the checksum check, a signature verification will be performed. This behavior can be enforced via the `--force-verification` flag.
Downloading the CLI is everything you need to give Chainloop a try, since, by default, it points to a [running instance of Chainloop](https://app.chainloop.dev).
57
-
58
-
You can also **run your own Chainloop instance** on your Kubernetes cluster by leveraging [this Helm Chart](./deployment/chainloop/).
59
-
60
-
### Configure CLI (optional)
61
-
62
-
If you are running your [own instance](https://github.com/chainloop-dev/chainloop) of the Control Plane. You can make the CLI point to your instance by using the `chainloop config save` command.
63
-
64
-
```sh
65
-
chainloop config save \
66
-
--control-plane my-controlplane.acme.com \
67
-
--artifact-cas cas.acme.com
68
-
```
69
-
70
-
### Authentication
71
-
72
-
Authenticate to the Control Plane by running
73
-
74
-
```bash
75
-
$ chainloop auth login
76
-
```
77
-
78
-
### Finishing the setup
79
-
80
-
Once you've been logged in, follow [these instructions](https://docs.chainloop.dev/getting-started/setup) to learn how to set up your account.
81
-
82
18
## How does it work?
83
19
84
20
### Compliant Single Source of Truth
@@ -95,27 +31,32 @@ Chainloop also makes sure the crafting of artifacts and attestation follows **be
95
31
96
32
One key aspect is that in Chainloop, CI/CD integrations are declared via [**Workflow Contracts**](https://docs.chainloop.dev/getting-started/workflow-definition#workflow-contracts).
97
33
98
-
A [Workflow Contract](https://docs.chainloop.dev/reference/operator/contract) gives operators**full control over what kind of data (build info, materials) must be received as part of the attestation and the environment where these workflows must be executed at**. This enables an easy, and maintainable, way of propagating and enforcing requirements downstream to your organization.
34
+
A [Workflow Contract](https://docs.chainloop.dev/reference/operator/contract) gives Compliance and Security teams**full control over what kind of data (build info, materials) must be received as part of the attestation and the environment where these workflows must be executed at**. This enables an easy, and maintainable, way of propagating and enforcing requirements downstream to your organization.
99
35
100
-
You can think of it as an [**API for your organization's Software Supply Chain**](https://docs.chainloop.dev/reference/operator/contract) that both parties, development and SecOps teams can use to interact effectively.
36
+
You can think of it as an [**API for your organization's Software Supply Chain**](https://docs.chainloop.dev/reference/operator/contract) that both parties, development and Compliance and Security teams can use to interact effectively.
101
37
102
38

103
39
40
+
### Policy as code
41
+
42
+
Compliance and Security teams can [craft](https://docs.chainloop.dev/guides/rego-policies/)[Rego](https://www.openpolicyagent.org/docs/latest/policy-language/) policies, and [attach](https://docs.chainloop.dev/reference/policies) them to workflow contracts. Those policies will be automatically evaluated, and their results will be added to the attestation before signing and storage.
43
+
44
+
104
45
### We meet you where you are with third-party integrations
105
46
106
47
Operators can set up third-party integrations such as [Dependency-Track](https://docs.chainloop.dev/guides/dependency-track), or [Guac](https://docs.chainloop.dev/guides/guac/) for SBOM analysis or a storage backend such as an OCI registry, or cloud blob storage to place the received artifacts, pieces of evidence and attestation metadata.
107
48
108
49

109
50
110
-
Ops can mix and match with different integrations while **not requiring developers to make any changes on their side**!
51
+
Compliance and Security teams can mix and match with different integrations while **not requiring developers to make any changes on their side**!
111
52
112
53
To learn more and to find the list of available integrations, check our [integrations page](./devel/integrations.md).
113
54
114
55
### Role-tailored experience
115
56
116
-
Chainloop makes sure to clearly define the responsibilities, experience and functional scope of the **two main personas, Security/Operation (SecOps) and Development/Application teams**.
57
+
Chainloop makes sure to clearly define the responsibilities, experience and functional scope of the **two main personas, Compliance/Security and Development teams**.
117
58
118
-
SecOps are the ones in charge of defining the Workflow Contracts, setting up third-party integrations, or having access to the control plane where all the Software Supply Chain Security bells and whistles are exposed.
59
+
Compliance and Security teams are the ones in charge of defining the Workflow Contracts, crafting policies, setting up third-party integrations, or having access to the control plane where all the Software Supply Chain Security bells and whistles are exposed.
119
60
120
61
Development teams on the other hand, just need to integrate Chainloop's jargon-free [crafting tool](https://docs.chainloop.dev/getting-started/attestation-crafting) and follow the steps via a familiar DevExp to make sure they comply with the Workflow Contract defined by the SecOps team. No need to learn in-toto, signing, SLSA, OCI, APIs, nada :)
121
62
@@ -146,7 +87,65 @@ Chainloop supports the collection of the following list of evidence types. For t
146
87
- Custom Evidence Type: Custom piece of evidence that doesn't fit in any other category, for instance, an approval report in json format, etc.
147
88
- Key-Value metadata pairs
148
89
90
+
## Getting started
91
+
92
+
See the [getting started guide](https://docs.chainloop.dev/getting-started/installation#command-line-interface-cli-installation) for detailed information on a) how to download and configure the Chainloop CLI and b) how to deploy Chainloop on your Kubernetes Cluster.
93
+
94
+
### Command Line Interface (CLI) installation
95
+
96
+
> Alternatively, you can download the CLI from the [releases pages](https://github.com/chainloop-dev/chainloop/releases) or [build it from source](./CONTRIBUTING.md).
97
+
98
+
To **install the latest version** for macOS, Linux or Windows (using [WSL](https://learn.microsoft.com/en-us/windows/wsl/install)) just choose one of the following installation methods.
if [`cosign`](https://docs.sigstore.dev/cosign) is present in your system, in addition to the checksum check, a signature verification will be performed. This behavior can be enforced via the `--force-verification` flag.
Downloading the CLI is everything you need to give Chainloop a try, since, by default, it points to a [running instance of Chainloop](https://app.chainloop.dev).
125
+
126
+
You can also **run your own Chainloop instance** on your Kubernetes cluster by leveraging [this Helm Chart](./deployment/chainloop/).
127
+
128
+
### Configure CLI (optional)
129
+
130
+
If you are running your [own instance](https://github.com/chainloop-dev/chainloop) of the Control Plane. You can make the CLI point to your instance by using the `chainloop config save` command.
131
+
132
+
```sh
133
+
chainloop config save \
134
+
--control-plane my-controlplane.acme.com \
135
+
--artifact-cas cas.acme.com
136
+
```
137
+
138
+
### Authentication
139
+
140
+
Authenticate to the Control Plane by running
141
+
142
+
```bash
143
+
$ chainloop auth login
144
+
```
145
+
146
+
### Finishing the setup
147
+
148
+
Once you've been logged in, follow [these instructions](https://docs.chainloop.dev/getting-started/setup) to learn how to set up your account.
150
149
## Documentation
151
150
152
151
To learn more, please visit the Chainloop project's documentation website, https://docs.chainloop.dev where you will find a getting started guide, FAQ, examples, and more.
0 commit comments