Command Line Reference (EE)

chainloop apply [flags]

Apply resources from a single file
chainloop apply -f my-framework.yaml

Preview what would change without applying
chainloop apply -f my-framework.yaml --dry-run

Apply resources from a directory
chainloop apply -f ./compliance/

Output as JSON for CI/CD consumption
chainloop apply -f ./compliance/ --dry-run -o json

Validate a batch offline (no server needed)
chainloop apply -f ./compliance/ --dry-run --offline

Apply a repo root, skipping non-resource YAML (e.g. GitHub Actions)
chainloop apply -f ./ --exclude '.github/**'

--dry-run               preview changes without applying them
--exclude stringArray   glob pattern(s) of files/dirs to skip (repeatable); a .chainloopignore file in the directory is also honored
-f, --file string           path to a YAML file or directory
-h, --help                  help for apply
--offline               validate cross-references against batch contents only, without querying the server (requires --dry-run)

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

-h, --help   help for artifact

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop artifact download [flags]

-d, --digest string   digest of the file to download
-h, --help            help for download
--output file     The file to write a single asset to (use "-" to write to standard output
--path string     download path, default to current directory

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop artifact help [command] [flags]

-h, --help   help for help

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop artifact upload [flags]

-f, --file string   path to file to upload
-h, --help          help for upload

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

Refer to https://docs.chainloop.dev/getting-started/attestation-crafting

--graceful-exit             exit 0 in case of error. NOTE: this flag will be removed once Chainloop reaches 1.0
-h, --help                      help for attestation
--local-state-path string   path to store the attestation state locally, default: [tmpDir]/chainloop_attestation.tmp.json

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop attestation add [flags]

Add a material to the attestation that is defined in the contract
chainloop attestation add --name <material-name> --value <material-value>

Add a material to the attestation that is not defined in the contract but you know the kind
chainloop attestation add --kind <material-kind> --value <material-value>

Add a material to the attestation without specifying neither kind nor name enables automatic detection
chainloop attestation add --value <material-value>

Add a material by also providing a URL pointing to the material. It will be downloaded to a temporary folder first
chainloop attestation add --value https://example.com/sbom.json

Feed a policy input from a column of a CSV/JSON file (e.g. the ignored_paths exclusion list for the sigcheck binary-signing policies).
The :column suffix selects the column; it defaults to the input name when omitted. The file is also recorded as EVIDENCE.
chainloop attestation add --name sigcheck --value sigcheckResult.csv --kind SYSINTERNALS_SIGCHECK \
--policy-input-from-file ignored_paths=exception.csv:Path

Scope an input to a specific policy with a <policy>: prefix so it only applies to that policy attachment.
chainloop attestation add --name sigcheck --value sigcheckResult.csv --kind SYSINTERNALS_SIGCHECK \
--policy-input-from-file trusted-binaries-signed:ignored_paths=exception.csv:Path \
--policy-input-from-file trusted-binaries-vendor-keys:third_party_paths=exception.csv:Path

--annotation strings                   additional annotation in the format of key=value
--attestation-id string                Unique identifier of the in-progress attestation
-h, --help                                 help for add
--kind string                          kind of the material to be recorded: ["ARTIFACT" "ASYNCAPI_SPEC" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CERTCC_DRANZER" "CHAINLOOP_AI_AGENT_CONFIG" "CHAINLOOP_AI_CODING_SESSION" "CHAINLOOP_PR_INFO" "CHAINLOOP_RUNNER_CONTEXT" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "GITLEAKS_JSON" "GRAPHQL_SPEC" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "OPENAPI_SPEC" "OPENVEX" "OSSF_SCORECARD_JSON" "RADAMSA_CRASHES" "RADAMSA_REPORT" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "SYSINTERNALS_ACCESSCHK" "SYSINTERNALS_SIGCHECK" "TWISTCLI_SCAN_JSON" "YELP_DETECT_SECRETS_BASELINE" "ZAP_DAST_ZIP"]
--name string                          name of the material as shown in the contract
--no-strict-validation                 skip strict schema validation for structured materials (SBOM_CYCLONEDX_JSON, OPENAPI_SPEC, ASYNCAPI_SPEC, OSSF_SCORECARD_JSON)
--policy-input-from-file stringArray   feed a policy input from a column of a CSV or JSON file, in the format [<policy>:]<input>=<file>[:<column>] (e.g. ignored_paths=exception.csv:Path); an optional <policy>: prefix scopes the input to a single policy (matched by name or ref), otherwise it applies to every declaring policy; <column> is a single top-level column/field name and defaults to the input name; repeatable. The file is also recorded as EVIDENCE.
--registry-password string             registry password, ($CHAINLOOP_REGISTRY_PASSWORD)
--registry-server string               OCI repository server, ($CHAINLOOP_REGISTRY_SERVER)
--registry-username string             registry username, ($CHAINLOOP_REGISTRY_USERNAME)
--value string                         value to be recorded

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
--graceful-exit             exit 0 in case of error. NOTE: this flag will be removed once Chainloop reaches 1.0
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--local-state-path string   path to store the attestation state locally, default: [tmpDir]/chainloop_attestation.tmp.json
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop attestation help [command] [flags]

-h, --help   help for help

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
--graceful-exit             exit 0 in case of error. NOTE: this flag will be removed once Chainloop reaches 1.0
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--local-state-path string   path to store the attestation state locally, default: [tmpDir]/chainloop_attestation.tmp.json
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop attestation init [flags]

--collectors strings      comma-separated list of additional collectors to enable (e.g. aiconfig)
--contract string         name of an existing contract or the path/URL to a contract file, to attach it to the auto-created workflow (it doesn't update an existing one)
--contract-revision int   revision of the contract to retrieve, "latest" by default
--dry-run                 do not record attestation in the control plane, useful for development
--existing-version        return an error if the version doesn't exist in the project
-h, --help                    help for init
--latest-version          use the latest existing project version instead of specifying one
--mark-latest             explicitly mark the project version as latest (default: automatic for new versions; use =false to skip promotion) (default true)
--project string          name of the project of this workflow
--release                 promote the provided version as a release
--remote-state            Store the attestation state remotely
-f, --replace                 replace any existing in-progress attestation
--version string          project version, i.e 0.1.0
--workflow string         name of the workflow to run the attestation

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
--graceful-exit             exit 0 in case of error. NOTE: this flag will be removed once Chainloop reaches 1.0
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--local-state-path string   path to store the attestation state locally, default: [tmpDir]/chainloop_attestation.tmp.json
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop attestation push [flags]

chainloop attestation push --key <key path>|<env://VAR_NAME> --token [chainloop-token] --annotation key=value,key2=val2

sign the resulting attestation using a cosign key present in the filesystem and stdin for the passphrase
NOTE that the --token flag can be replaced by having the CHAINLOOP_TOKEN env variable
chainloop attestation push --key cosign.key --token [chainloop-token]

or retrieve the key from an environment variable containing the private key
chainloop attestation push --key env://[ENV_VAR]

The passphrase can be retrieved from a well-known environment variable
export CHAINLOOP_SIGNING_PASSWORD="my cosign key passphrase"
chainloop attestation push --key cosign.key

You can provide values for the annotations that have previously defined in the contract for example
chainloop attestation push --annotation key=value --annotation key2=value2
Or alternatively
chainloop attestation push --annotation key=value,key2=value2

--annotation strings              additional annotation in the format of key=value
--attestation-id string           Unique identifier of the in-progress attestation
--bundle string                   output a Sigstore bundle to the provided path
--deactivate-ci-report            deactivate automatic attestation report to CI/CD platform
--exception-bypass-policy-check   do not fail this command on policy violations enforcement
-h, --help                            help for push
-k, --key string                      reference (path or env variable name) to the cosign or KMS key that will be used to sign the attestation
--signserver-ca-path string       custom CA to be used for SignServer TLS connection
--signserver-client-cert string   path to client certificate in PEM format for authenticated SignServer TLS connection
--signserver-client-pass string   certificate passphrase for authenticated SignServer TLS connection

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
--graceful-exit             exit 0 in case of error. NOTE: this flag will be removed once Chainloop reaches 1.0
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--local-state-path string   path to store the attestation state locally, default: [tmpDir]/chainloop_attestation.tmp.json
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop attestation reset [flags]

--attestation-id string   Unique identifier of the in-progress attestation
-h, --help                    help for reset
--reason string           reset reason
--trigger string          trigger for the reset, valid options are "failure" and "cancellation" (default "failure")

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
--graceful-exit             exit 0 in case of error. NOTE: this flag will be removed once Chainloop reaches 1.0
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--local-state-path string   path to store the attestation state locally, default: [tmpDir]/chainloop_attestation.tmp.json
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop attestation status [flags]

--attestation-id string   Unique identifier of the in-progress attestation
--full                    full report including current recorded values
-h, --help                    help for status

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
--graceful-exit             exit 0 in case of error. NOTE: this flag will be removed once Chainloop reaches 1.0
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--local-state-path string   path to store the attestation state locally, default: [tmpDir]/chainloop_attestation.tmp.json
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop attestation verify file-or-url

verify local attestation
chainloop attestation verify --bundle attestation.json

verify an attestation stored in an https endpoint
chainloop attestation verify -b https://myrepository/attestation.json

-b, --bundle string   bundle path or URL
-h, --help            help for verify

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
--graceful-exit             exit 0 in case of error. NOTE: this flag will be removed once Chainloop reaches 1.0
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--local-state-path string   path to store the attestation state locally, default: [tmpDir]/chainloop_attestation.tmp.json
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

-h, --help   help for auth

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop auth delete-account [flags]

-h, --help   help for delete-account

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop auth help [command] [flags]

-h, --help   help for help

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop auth login [flags]

-h, --help           help for login
--skip-browser   perform a headless login process without opening a browser

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

-h, --help   help for cas-backend

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

--default              set the backend as default in your organization
--description string   descriptive information for this registration
--fallback             set the backend as fallback in your organization
-h, --help                 help for add
--max-bytes string     Maximum size for each blob stored in this backend (e.g., 100MB, 1GB)
--name string          CAS backend name

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop cas-backend add aws-s3 [flags]

--access-key-id string       AWS Access Key ID
--bucket string              S3 bucket name
--endpoint string            Custom Endpoint URL for other S3 compatible backends i.e MinIO
-h, --help                       help for aws-s3
--region string              AWS region for the bucket
--secret-access-key string   AWS Secret Access Key

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
--default                   set the backend as default in your organization
--description string        descriptive information for this registration
--fallback                  set the backend as fallback in your organization
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-bytes string          Maximum size for each blob stored in this backend (e.g., 100MB, 1GB)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
--name string               CAS backend name
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop cas-backend add azure-blob [flags]

--client-id string         Service Principal Client ID
--client-secret string     Service Principal Client Secret
--container string         Storage Container Name (default "chainloop")
--endpoint string          Custom Azure Blob endpoint suffix (e.g., blob.core.usgovcloudapi.net), if not provided, the public Azure cloud endpoint will be used.
-h, --help                     help for azure-blob
--storage-account string   Storage Account Name
--tenant string            Active Directory Tenant ID

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
--default                   set the backend as default in your organization
--description string        descriptive information for this registration
--fallback                  set the backend as fallback in your organization
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-bytes string          Maximum size for each blob stored in this backend (e.g., 100MB, 1GB)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
--name string               CAS backend name
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop cas-backend add help [command] [flags]

-h, --help   help for help

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
--default                   set the backend as default in your organization
--description string        descriptive information for this registration
--fallback                  set the backend as fallback in your organization
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-bytes string          Maximum size for each blob stored in this backend (e.g., 100MB, 1GB)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
--name string               CAS backend name
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop cas-backend add oci [flags]

-h, --help              help for oci
-p, --password string   registry password
--repo string       FQDN repository name, including path
-u, --username string   registry username

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
--default                   set the backend as default in your organization
--description string        descriptive information for this registration
--fallback                  set the backend as fallback in your organization
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-bytes string          Maximum size for each blob stored in this backend (e.g., 100MB, 1GB)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
--name string               CAS backend name
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop cas-backend delete [flags]

-h, --help          help for delete
--name string   CAS Backend name

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop cas-backend help [command] [flags]

-h, --help   help for help

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop cas-backend list [flags]

--full   show the full output
-h, --help   help for list

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

--default              set the backend as default in your organization
--description string   descriptive information for this registration
--fallback             set the backend as fallback in your organization
-h, --help                 help for update
--max-bytes string     Maximum size for each blob stored in this backend (e.g., 100MB, 1GB). Note: not supported for inline backends.
--name string          CAS backend name

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop cas-backend update aws-s3 [flags]

--access-key-id string       AWS Access Key ID
-h, --help                       help for aws-s3
--name string                CAS Backend name
--region string              AWS region for the bucket
--secret-access-key string   AWS Secret Access Key

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
--default                   set the backend as default in your organization
--description string        descriptive information for this registration
--fallback                  set the backend as fallback in your organization
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-bytes string          Maximum size for each blob stored in this backend (e.g., 100MB, 1GB). Note: not supported for inline backends.
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop cas-backend update azure-blob [flags]

--client-id string       Service Principal Client ID
--client-secret string   Service Principal Client Secret
-h, --help                   help for azure-blob
--name string            CAS Backend name
--tenant string          Active Directory Tenant ID

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
--default                   set the backend as default in your organization
--description string        descriptive information for this registration
--fallback                  set the backend as fallback in your organization
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-bytes string          Maximum size for each blob stored in this backend (e.g., 100MB, 1GB). Note: not supported for inline backends.
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop cas-backend update help [command] [flags]

-h, --help   help for help

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
--default                   set the backend as default in your organization
--description string        descriptive information for this registration
--fallback                  set the backend as fallback in your organization
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-bytes string          Maximum size for each blob stored in this backend (e.g., 100MB, 1GB). Note: not supported for inline backends.
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
--name string               CAS backend name
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop cas-backend update inline [flags]

-h, --help          help for inline
--name string   CAS Backend name

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
--default                   set the backend as default in your organization
--description string        descriptive information for this registration
--fallback                  set the backend as fallback in your organization
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-bytes string          Maximum size for each blob stored in this backend (e.g., 100MB, 1GB). Note: not supported for inline backends.
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop cas-backend update oci [flags]

-h, --help              help for oci
--name string       CAS Backend name
-p, --password string   registry password
-u, --username string   registry username

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
--default                   set the backend as default in your organization
--description string        descriptive information for this registration
--fallback                  set the backend as fallback in your organization
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-bytes string          Maximum size for each blob stored in this backend (e.g., 100MB, 1GB). Note: not supported for inline backends.
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

-h, --help   help for config

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop config help [command] [flags]

-h, --help   help for help

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

-h, --help   help for plugin

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop config plugin describe [flags]

-h, --help          help for describe
--name string   Name of the plugin to describe (required)

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop config plugin help [command] [flags]

-h, --help   help for help

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop config plugin install [flags]

-f, --file string   URL or path to the plugin to install
-h, --help          help for install

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop config plugin list [flags]

-h, --help   help for list

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop config reset [flags]

-h, --help   help for reset

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop config save [flags]

chainloop config save --control-plane localhost:1234 --artifact-cas localhost:1235

-h, --help   help for save

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop config view [flags]

-h, --help   help for view

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

-h, --help   help for deployment

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop deployment help [command] [flags]

-h, --help   help for help

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop deployment list [flags]

List deployment records (shows latest per slot by default)
chainloop deployment list

Filter by environment
chainloop deployment list --env prod-k8s

Filter by project and version
chainloop deployment list --project my-project --project-version v1.0.0

Filter by status
chainloop deployment list --status deployed

Show full history for a specific slot
chainloop deployment list --env prod-k8s --name myapp-web --history

Show full history for all slots
chainloop deployment list --history

--env string               filter by environment name
-h, --help                     help for list
--history                  show full history instead of only the latest record per slot
--limit int32              number of items per page (default 50)
--logical-env string       filter by logical environment name
--name string              filter by deployment name (slot identifier)
--page int32               page number (starts at 1) (default 1)
--project string           filter by project name
--project-version string   filter by project version (requires --project)
--status string            filter by deployment status (deployed, decommissioned, superseded)

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop deployment record [flags]

Record a container image deployment using an OCI reference (resolves digest automatically)
chainloop deployment record --env prod-k8s --oci-ref ghcr.io/chainloop-dev/platform/backend:v1.31.0 --kind CONTAINER_IMAGE --status deployed --deployment-name backend --logical-env production

Record using a pre-computed digest (no image reference needed)
chainloop deployment record --env prod-k8s --digest sha256:abc123 --kind CONTAINER_IMAGE --status deployed --deployment-name myapp-web --logical-env staging

Record with explicit registry credentials
chainloop deployment record --env prod-k8s --oci-ref private.registry.io/myapp:latest --kind CONTAINER_IMAGE --status deployed --deployment-name myapp --logical-env production --registry-server private.registry.io --registry-username user --registry-password pass

--deployment-name string     stable slot identifier within an environment
--digest string              artifact digest (mutually exclusive with --oci-ref)
--env string                 environment name
-h, --help                       help for record
--kind string                artifact kind (CONTAINER_IMAGE, HELM_CHART)
--logical-env string         logical environment name (e.g. staging, production)
--oci-ref string             OCI image reference to resolve digest from (e.g. ghcr.io/org/repo:tag)
--registry-password string   registry password ($CHAINLOOP_REGISTRY_PASSWORD)
--registry-server string     OCI registry server ($CHAINLOOP_REGISTRY_SERVER)
--registry-username string   registry username ($CHAINLOOP_REGISTRY_USERNAME)
--status string              deployment status (deployed, decommissioned, superseded)

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop discover [flags]

-d, --digest string   hash of the attestation, piece of evidence or artifact, i.e sha256:deadbeef
-h, --help            help for discover
-k, --kind string     optional kind of the referrer, used to disambiguate between multiple referrers with the same digest
--limit int       number of items to show (default 20)
--next string     cursor to load the next page
--public          discover from public shared index instead of your organizations'

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

-h, --help   help for environment

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop environment create [flags]

Create a Kubernetes environment
chainloop environment create --name prod-k8s --type kubernetes

Create an environment with description
chainloop environment create --name staging-ecs --type ecs --description "Staging ECS cluster"

--description string   environment description
-h, --help                 help for create
--name string          environment name (DNS-1123 format: lowercase, numbers, hyphens)
--type string          environment type (kubernetes, ecs, server, lambda, custom)

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop environment delete [flags]

Delete an environment (with confirmation prompt)
chainloop environment delete --name prod-k8s

Delete without confirmation
chainloop environment delete --name prod-k8s --yes

-h, --help          help for delete
--name string   environment name
-y, --yes           skip confirmation prompt

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN

chainloop environment describe [flags]

Describe an environment by name
chainloop environment describe --name prod-k8s

-h, --help          help for describe
--name string   environment name

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop environment help [command] [flags]

-h, --help   help for help

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop environment list [flags]

List all environments
chainloop environment list

Filter by query
chainloop environment list --query prod

-h, --help           help for list
--limit int32    number of items per page (default 50)
--page int32     page number (starts at 1) (default 1)
--query string   search across name and description

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

-h, --help   help for logical

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop environment logical create [flags]

Create a logical environment
chainloop environment logical create --name QA --description "Quality assurance environments"

--description string   logical environment description
-h, --help                 help for create
--name string          logical environment name

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop environment logical delete [flags]

Delete a logical environment (with confirmation prompt)
chainloop environment logical delete --name QA

Delete without confirmation
chainloop environment logical delete --name QA --yes

-h, --help          help for delete
--name string   logical environment name
-y, --yes           skip confirmation prompt

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN

chainloop environment logical describe [flags]

Describe a logical environment by name
chainloop environment logical describe --name Production

-h, --help          help for describe
--name string   logical environment name

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop environment logical help [command] [flags]

-h, --help   help for help

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop environment logical list [flags]

List all logical environments
chainloop environment logical list

Search by query
chainloop environment logical list --query prod

-h, --help           help for list
--limit int32    number of items per page (default 50)
--page int32     page number (starts at 1) (default 1)
--query string   search across name and description

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop environment logical update [flags]

Update logical environment description
chainloop environment logical update --name Production --description "Production deployment environments"

--description string   new description
-h, --help                 help for update
--name string          logical environment name

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop environment update [flags]

Update environment description
chainloop environment update --name prod-k8s --description "Production Kubernetes cluster"

Change environment type
chainloop environment update --name prod-k8s --type ecs

--description string   new description
-h, --help                 help for update
--name string          environment name
--type string          new environment type (kubernetes, ecs, server, lambda, custom)

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

-h, --help   help for evidence

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop evidence help [command] [flags]

-h, --help   help for help

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop evidence list [flags]

List all evidence
chainloop evidence list

Filter by project
chainloop evidence list --project myapp

Filter by project version
chainloop evidence list --project myapp --project-version v1.0.0

Filter by product
chainloop evidence list --product-id <uuid> --product-version-id <uuid>

Filter by kind (multiple)
chainloop evidence list --kind SBOM_CYCLONEDX_JSON --kind SARIF

Search by name, subject, or digest
chainloop evidence list --search sha256:abc123...

Pagination
chainloop evidence list --project myapp --limit 20
chainloop evidence list --project myapp --limit 20 --next MjAy...

JSON output
chainloop evidence list --project myapp --output json

-h, --help                        help for list
--hide-attestation            exclude attestation evidence from results
--kind strings                evidence kind (repeatable, e.g., SBOM_CYCLONEDX_JSON, SARIF)
--latest                      show only latest evidence (requires project or product filter)
--limit int32                 number of items to show (1-200) (default 50)
--next string                 cursor to load the next page
--product-id string           product ID (requires --product-version-id)
--product-version-id string   product version ID (requires --product-id)
--project string              project name
--project-version string      project version name (requires --project)
--search string               search by evidence name, subject name, or digest
--workflow strings            workflow name (repeatable)

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

-h, --help   help for finding

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

-h, --help   help for assessment

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop finding assessment create [flags]

Mark a CVE as not-affected for a project, with a justification
chainloop finding assessment create \
--external-id CVE-2024-1234 --project my-project \
--status not-affected --justification vulnerable-code-not-present \
--note "the affected function is never called"

Scope an assessment to a specific version and restrict it to a package
chainloop finding assessment create \
--external-id CVE-2024-1234 --project my-project --project-version v1.2.3 \
--status affected --product 'pkg:npm/lodash@*'

--external-id string       CVE/advisory ID (e.g. CVE-2024-1234)
-h, --help                     help for create
--justification string     justification code, required when --status=not-affected (component-not-present, vulnerable-code-not-present, vulnerable-code-cannot-be-controlled, vulnerable-code-not-in-execute-path, inline-mitigations-already-exist)
--note string              free-text note
--product stringArray      PURL glob pattern identifying an affected product (repeatable, e.g. pkg:npm/lodash@*)
--project string           project name
--project-version string   scope the assessment to a specific project version
--status string            status (not-affected, affected, under-investigation, fixed)

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop finding assessment help [command] [flags]

-h, --help   help for help

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop finding assessment list [flags]

List all assessments
chainloop finding assessment list

List not-affected assessments for a project
chainloop finding assessment list --project my-project --status not-affected

List assessments linked to a specific finding
chainloop finding assessment list --finding 0c2f1e9a-1b3c-4d5e-8f90-1234567890ab

List assessments for a CVE
chainloop finding assessment list --external-id CVE-2024-1234

--external-id string       filter by external ID (e.g. CVE identifier)
--finding string           filter by finding ID
-h, --help                     help for list
--limit int32              number of items per page (default 50)
--page int32               page number (starts at 1) (default 1)
--project string           filter by project name
--project-version string   filter by project version name (requires --project)
--scope string             filter by scope (project, project-version)
--status strings           filter by status, repeatable (not-affected, affected, under-investigation, fixed)

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop finding describe [flags]

Describe a finding by ID
chainloop finding describe --id 0c2f1e9a-1b3c-4d5e-8f90-1234567890ab

-h, --help        help for describe
--id string   finding ID

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop finding help [command] [flags]

-h, --help   help for help

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop finding list [flags]

List active findings (open and in-progress, the default)
chainloop finding list

List findings of every status, including resolved and rejected
chainloop finding list --status all

List critical and high findings for a project that are still open
chainloop finding list --project my-project --severity critical --severity high --status open

List unassessed, fixable findings in the CISA KEV catalog
chainloop finding list --is-assessed=false --is-fixable --is-in-kev

Search by CVE identifier
chainloop finding list --search CVE-2024

-h, --help                     help for list
--is-assessed              filter by whether the finding has been assessed
--is-fixable               filter by whether the finding has a fix available
--is-in-kev                filter by whether the finding is in the CISA KEV catalog
--limit int32              number of items per page (default 50)
--page int32               page number (starts at 1) (default 1)
--project string           filter by project name
--project-version string   filter by project version name (requires --project)
--search string            search by external ID substring (e.g. CVE identifier)
--severity strings         filter by severity (critical, high, medium, low, info)
--sort-by string           sort field (severity, last-seen-at, first-seen-at, created-at)
--sort-direction string    sort direction (asc, desc)
--status strings           filter by status (open, in-progress, resolved, rejected); pass 'all' to include every status (default [open,in-progress])
--type strings             filter by finding type (vulnerability)

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

-h, --help   help for framework

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop framework delete [flags]

Delete a framework (with confirmation prompt)
chainloop framework delete --name my-framework

Delete a framework without confirmation
chainloop framework delete --name my-framework --yes

-h, --help          help for delete
--name string   framework name
-y, --yes           skip confirmation prompt

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN

chainloop framework describe [flags]

Describe a framework
chainloop framework describe --name my-framework

Download the framework schema
chainloop framework describe --name my-framework --output schema

-h, --help          help for describe
--name string   framework name

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation

chainloop framework help [command] [flags]

-h, --help   help for help

--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
--debug                     Enable debug/verbose logging mode
-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
--max-recv-msg-size int     Max size in bytes for incoming gRPC messages (0 = default 33554432) ($CHAINLOOP_API_MAX_RECV_MSG_SIZE)
-n, --org string                organization name
-o, --output string             Output format, valid options are json and table (default "table")
--platform string           URL for the platform backend API ($CHAINLOOP_PLATFORM_API) (default "api.app.chainloop.dev:443")
--platform-ca string        CUSTOM CA file for the Platform API (optional) ($CHAINLOOP_PLATFORM_API_CA)
-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
-y, --yes                       Skip confirmation