Securing the Software Supply Chain with Chainloop

Chainloop is an open-source evidence store for software supply chain attestations, Software Bill of Materials (SBOMs), vulnerability reports (VEX), SARIF, CSAF files, QA reports, and more. By using Chainloop, you can ensure that all submitted metadata is attested, digitally signed, evaluated, routed, and securely stored.

By integrating Chainloop with EJBCA and SignServer, you get an end-to-end solution that will create in-toto attestations signed with SignServer and EJBCA, stored in an OCI registry. Two integrations are offered:

• Remote Signing of Attestations using Chainloop and SignServer

• Local Signing of Attestations with Chainloop and EJBCA Ephemeral Certificates