chainloop

chainloop copied to clipboard

Executing the policy sbom-with-licenses over the controlplane migrations sbom shows some components without licenses: Violations - Missing licenses for ariga.io/atlas/cmd/atlas (pkg:golang/ariga.io/atlas/[email protected]?package-id=cab9ec0d40a529be#atlas) - Missing licenses for github.com/ariga/language-tools/packages/language-server-go (pkg:golang/github.com/ariga/[email protected]?package-id=b71cbfd2cf76b196#packages/language-server-go) These packages are...

kaysavps

``` This command is will run against the organization "miguel" ``` `is` is not needed.

migmartri

Research how to autodetect Tekton pipelines as runners

1

Chainloop provides automatic detection of CI/CD environments to ensure attestations are created in the correct context and to capture relevant execution metadata. This capability, known as runner context, is essential...

javirln

Chainloop uses AWS SDK for Go (v1) which is EOL

4

Chainloop currently depends on AWS SDK for Go (v1), which has reached End-of-Life and is no longer maintained by AWS. This may introduce security risks and compatibility issues in the...

OlikPolik

feat(policies): add rego boilerplate injection

5

## Summary Implemented automatic missing boilerplate injection for rego policies in the engine before policy evaluation. ### Changes - Rego policy engine now detects missing required rules and injects them...

Piskoo

This PR adds validation to contract creation and update, that prevents assigning policies that contain execution path for kind `ATTESTATION` on material level. ## Example: For `sbom-present` policy ``` apiVersion:...

Piskoo

This is an umbrella issue created to track Chainloop's support for Tekton through multiple avenues. - [ ] Chainloop as a storage backend in Tekton Chains - [ ] Tekton...

waveywaves

Extend OCI layout image metadata with annotations

1

In https://github.com/chainloop-dev/chainloop/pull/2507 Chainloop got CONTAINER_IMAGE materials coming from local OCI layouts. In some cases, depending on the tool used, there might be some metadata that suits into current CONTAINER_IMAGE Chainloop...

jiparis

Feature request: garbage collection for orphan materials

1

During the attestation process, materials are uploaded to the storage backend through the CAS service. In cases where the attestation fails or is cancelled, those materials are kept forever in...

jiparis

Error decoding attestations with INLINE binary data

1

When using binary data, the `value` field is interpreted as a String, so the GRPC marshaler complains about invalid UTF-8 data: ```bash ➜ head -c 10 /dev/urandom > random.bin ➜...

jiparis