A new open-source tool called Chainloop provides organizations with an evidence store and policy engine for tracking software supply chain security. The tool automatically captures and verifies artifacts produced during software builds, creating an auditable record of the entire build process.
Chainloop operates as a command-line utility that integrates directly into existing CI/CD pipelines, including GitHub Actions, GitLab, Jenkins, and Dagger. When a build runs, the tool automatically identifies and collects the artifacts produced during that process. These files are then uploaded to content-addressable storage, ensuring each artifact can be uniquely identified and retrieved based on its content rather than location.
The technical foundation of Chainloop relies on the in-toto specification, an industry standard for recording software supply chain metadata. For each build step, Chainloop generates signed attestations that document who executed the step, what inputs were used, and what outputs were produced. These cryptographically signed records create a tamper-evident chain of custody for software artifacts, making it possible to verify the integrity and authenticity of builds after the fact.
The tool addresses a critical need for organizations trying to secure their software supply chains against tampering, unauthorized modifications, and compliance violations. By automatically collecting evidence at each stage of the build process, Chainloop eliminates manual record-keeping and reduces the risk of gaps in the audit trail. The content-addressable storage approach ensures that artifacts cannot be silently replaced or modified without detection.
Security and compliance teams can use Chainloop's control plane to review build evidence, enforce policies, and verify that software artifacts meet organizational requirements before deployment. The open-source nature of the project allows organizations to inspect the code, customize the tool for their specific needs, and integrate it with existing security infrastructure without vendor lock-in.
Source: https://www.helpnetsecurity.com/2026/08/10/chainloop-open-source-supply-chain-security/