chainloop-dev/chainloop

Allow hyphens in annotation names 13 days ago

good first issue

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

allow to rename workflows 3 months ago

good first issue Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

feat: being able to automatically pull and record attached SBOMS 4 months ago

enhancement good first issue component/CLI component/controlplane component/artifact-cas pinned security

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

feat(cli): support remote materials 5 months ago

good first issue component/CLI component/backend pinned

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

CLI: remove ResourceExhausted from retriable gRPC codes 5 months ago

good first issue component/CLI

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Standardize to chainloop.dev/v1 for apiVersion for policies 6 months ago

good first issue

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

replace inline secret_prefix option 7 months ago

enhancement good first issue component/artifact-cas Stale pinned

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

chart: improve installation output (notes.md) 7 months ago

enhancement good first issue component/CLI helm Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Improve go-releaser GitHub release step 7 months ago

enhancement good first issue component/backend housekeeping Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Extend extensions readme generator 7 months ago

documentation enhancement good first issue plugins sdk Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Improve the error message when CAS is the invalid state 7 months ago

bug good first issue component/CLI Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

feat: improve handling of over the limit uploads 7 months ago

bug good first issue

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Attestation result output for contract-less materials 7 months ago

good first issue component/backend Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Add goreleaser as new material kind 7 months ago

good first issue component/backend Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Allow material's outputs configuration. 7 months ago

good first issue component/backend Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

feat(policies): add gate support for policy groups 7 months ago

good first issue

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

repository info enforcement 7 months ago

enhancement good first issue component/CLI component/backend pinned

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Change initialization of schema validators 7 months ago

enhancement good first issue component/CLI pinned

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

add missing material types to reference table 7 months ago

documentation good first issue Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

log version at boot 7 months ago

good first issue component/backend pinned

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

change location of custom CAs 7 months ago

AI Summary: This GitHub issue proposes changing the storage location for custom CA certificates. The goal is to create dynamic mount points, such as `/etc/ssl/cert_{i}.pem`, to avoid overwriting the existing `/etc/ssl` directory, as discussed in a linked pull request.

Complexity: 3/5

good first issue deployment Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

CAS S3 backend endpoint validation 7 months ago

AI Summary: The `chainloop cas-backend add aws-s3` command fails with a misleading "504 Gateway Timeout" error when a custom S3 endpoint is provided without a scheme (e.g., `hostname:port`). The command succeeds if the scheme is included (e.g., `https://hostname:port`). The issue proposes adding validation to the endpoint input to provide a clearer, more informative error message to the user.

Complexity: 2/5

bug good first issue Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

feat(policies): allow disabling gating restrictions for specific policies 7 months ago

good first issue

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

keyless signing docs 9 months ago

good first issue

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

typo in attestation policy confirmation message 10 months ago

good first issue

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Open Issues Need Help