Chainloop

A Software Supply Chain Attestation solution devs won't hate. Agentic SDLC infrastructure. Define guardrails. Collect signals. Enforce continuously. Signed records of what your AI coding agents and CI/CD pipelines did, checked against policies as code, with the loop closed in CI/CD. AI sessions, SBOMs, VEX, SARIF and SLSA provenance, built on Sigstore and in-toto. Apache 2.0. === The Problem === You work on the Security and Operations (SecOps) team in charge of your organization's Software Supply Chain Security.

Open source

608 stars · GitHubexternal site

Visit github.comexternal site