Changelog

# Fail if version doesn't exist (useful for backpatches)
chainloop att init --workflow sast --project my-project --version v1.2.3 --existing-version

# Error output when version doesn't exist:
# ERR validation error: project version "v1.2.3" not found

# Create a new project
chainloop project create --name my-project --description "My project description"

# List all projects
chainloop project list

# Create a new prerelease version
chainloop project version create --project my-project --name v1.0.0

# Create a released version
chainloop project version create --project my-project --name v1.0.0 --is-released

# Example
apiVersion: chainloop.dev/v1
kind: Contract
metadata:
  name: my-workflow
spec:
  materials:
    - name: large-binary
      type: ARTIFACT
      skip_upload: true  # Only record metadata, don't upload to CAS
    - name: sbom
      type: SBOM_CYCLONEDX_JSON
      # skip_upload defaults to false - normal upload behavior

chainloop att init --workflow sast --project my-project-2222
ERR creating workflows during the attestation process is disabled for this organization. Please create them in advance or contact your administrator

# Evaluate policy from HTTP URL
chainloop policy devel eval --policy https://raw.githubusercontent.com/chainloop-dev/chainloop/main/docs/examples/policies/quickstart/cdx-fresh.yaml --material sbom.json
{
 "result": {
    "violations": [
       "SBOM created at: 2024-01-09T12:00:00Z which is too old (freshness limit set to 30 days)"
    ],
    "skip_reasons": [],
    "skipped": false
 }
}

# Evaluate policy from Chainloop registry
chainloop policy devel eval --policy chainloop://sbom-ntia --material sbom.json
{
 "result": {
    "violations": [
       "missing author",
       "missing supplier for 'AES-256-GCM'",
       "missing supplier for 'ECDH'",
       "missing supplier for 'RSA-2048'",
       "missing supplier for 'SHA384'",
       "missing supplier for 'SHA512withRSA'",
       "missing supplier for 'TLSv1.2'",
       "missing supplier for 'google.com'",
       "missing unique identifier (PURL, CPE, SWID) for 'AES-256-GCM'",
       "missing unique identifier (PURL, CPE, SWID) for 'ECDH'",
       "missing unique identifier (PURL, CPE, SWID) for 'RSA-2048'",
       "missing unique identifier (PURL, CPE, SWID) for 'SHA384'",
       "missing unique identifier (PURL, CPE, SWID) for 'SHA512withRSA'",
       "missing unique identifier (PURL, CPE, SWID) for 'TLSv1.2'",
       "missing unique identifier (PURL, CPE, SWID) for 'google.com'",
       "missing version for 'AES-256-GCM'",
       "missing version for 'ECDH'",
       "missing version for 'RSA-2048'",
       "missing version for 'SHA384'",
       "missing version for 'SHA512withRSA'",
       "missing version for 'TLSv1.2'",
       "missing version for 'google.com'"
    ],
    "skip_reasons": [],
    "skipped": false
 }
}

# Single image layout (automatic)
chainloop attestation add \
  --name my-app \
  --value /path/to/oci-layout \
  --kind CONTAINER_IMAGE

# Multi-image layout (requires digest selector)
chainloop attestation add \
  --name my-app \
  --value /path/to/oci-layout@sha256:9a7ef86e19... \
  --kind CONTAINER_IMAGE

# Create or update a policy group
chainloop policy-group apply --file sbom-quality.yaml

# List all policy groups
chainloop policy-group list

# Describe a specific policy group
chainloop policy-group describe --name sbom-quality

# Install CLI Enterprise Edition
curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- -ee