chainloop-dev/chainloop

feat(trace): skip agent hooks when the Chainloop CLI is unavailable 14 days ago

good first issue component/CLI trace-provider

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Return a known error when the attestation state cannot be decrypted with the current token 27 days ago

bug good first issue UX

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Allow hyphens in annotation names about 2 months ago

good first issue

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

allow to rename workflows 5 months ago

good first issue Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

feat: being able to automatically pull and record attached SBOMS 5 months ago

enhancement good first issue component/CLI component/controlplane component/artifact-cas pinned security

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

feat(cli): support remote materials 7 months ago

good first issue component/CLI component/backend pinned

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

CLI: remove ResourceExhausted from retriable gRPC codes 7 months ago

good first issue component/CLI

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Standardize to chainloop.dev/v1 for apiVersion for policies 8 months ago

good first issue

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

replace inline secret_prefix option 8 months ago

enhancement good first issue component/artifact-cas Stale pinned

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

chart: improve installation output (notes.md) 8 months ago

enhancement good first issue component/CLI helm Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Improve go-releaser GitHub release step 8 months ago

enhancement good first issue component/backend housekeeping Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Extend extensions readme generator 8 months ago

documentation enhancement good first issue plugins sdk Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Improve the error message when CAS is the invalid state 8 months ago

bug good first issue component/CLI Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

feat: improve handling of over the limit uploads 8 months ago

bug good first issue

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Attestation result output for contract-less materials 8 months ago

good first issue component/backend Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Add goreleaser as new material kind 8 months ago

good first issue component/backend Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Allow material's outputs configuration. 8 months ago

good first issue component/backend Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

feat(policies): add gate support for policy groups 8 months ago

good first issue

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

repository info enforcement 8 months ago

enhancement good first issue component/CLI component/backend pinned

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Change initialization of schema validators 8 months ago

enhancement good first issue component/CLI pinned

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

add missing material types to reference table 8 months ago

documentation good first issue Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

log version at boot 8 months ago

good first issue component/backend pinned

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

change location of custom CAs 8 months ago

AI Summary: This GitHub issue proposes changing the storage location for custom CA certificates. The goal is to create dynamic mount points, such as `/etc/ssl/cert_{i}.pem`, to avoid overwriting the existing `/etc/ssl` directory, as discussed in a linked pull request.

Complexity: 3/5

good first issue deployment Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

CAS S3 backend endpoint validation 8 months ago

AI Summary: The `chainloop cas-backend add aws-s3` command fails with a misleading "504 Gateway Timeout" error when a custom S3 endpoint is provided without a scheme (e.g., `hostname:port`). The command succeeds if the scheme is included (e.g., `https://hostname:port`). The issue proposes adding validation to the endpoint input to provide a clearer, more informative error message to the user.

Complexity: 2/5

bug good first issue Stale

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

feat(policies): allow disabling gating restrictions for specific policies 8 months ago

good first issue

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

keyless signing docs 11 months ago

good first issue

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

typo in attestation policy confirmation message 12 months ago

good first issue

chainloop-dev/chainloop

583

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Go

#attestation#compliance#cyclonedx#devsecops#in-toto#license#metadata-platform#open-source-licensing#ospo#oss-compliance#regulated-industry#sbom#sbom-discovery#sbom-distribution#security#slsa#slsa-provenance#spdx#supply-chain-security

Open Issues Need Help