Contracts

chainloop org update --name [my-org-name] --restrict-contract-creation

apiVersion: chainloop.dev/v1
kind: Contract
metadata:
  name: skynet-contract
spec:
  # Arbitrary set of annotations can be added to the contract and will be part of the attestation
  annotations:
    - name: version
      value: oss # if the value is left empty, it will be required and resolved at attestation time
  # https://docs.chainloop.dev/concepts/operator/material-types
  materials:
    # CONTAINER_IMAGE kinds will get resolved to retrieve their repository digest
    - type: CONTAINER_IMAGE
      name:
        skynet-control-plane
        # The output flag indicates that the material will be part of the attestation subject
      output: true
      # Arbitrary annotations can be added to the material
      annotations:
        - name: component
          value: control-plane
        # The value can be left empty so it can be provided at attestation time
        - name: asset
    # ARTIFACT kinds will first get uploaded to your artifact registry via the built-in Content Addressable Storage (CAS)
    # Optional dockerfile
    - type: ARTIFACT
      name: dockerfile
      optional: true
    # SBOMs will be uploaded to the artifact registry and referenced in the attestation
    # Both SBOM_CYCLONEDX_JSON and SBOM_SPDX_JSON are supported
    - type: SBOM_CYCLONEDX_JSON
      name: skynet-sbom
    # CSAF_VEX and OPENVEX are supported
    - type: OPENVEX
      name: disclosure
    # And static analysis reports in SARIF format
    - type: SARIF
      name: static-out
    # or additional tools
    - type: TWISTCLI_SCAN_JSON
      name: scan-result
    # Large artifact that's already stored externally - skip CAS upload but record metadata
    - type: ARTIFACT
      name: large-binary
      skip_upload: true
  # https://docs.chainloop.dev/concepts/policies
  policies:
    materials: # policies applied to materials
      - ref: file://cyclonedx-licenses.yaml
    attestation: # policies applied to the whole attestation
      - ref: https://github.com/chainloop/chainloop-dev/blob/main/docs/examples/policies/chainloop-commit.yaml # (2)
        gate: true # Enable/disable (true/false) control gate per policy, overrides org default https://docs.chainloop.dev/concepts/control-gates
  # Env vars we want the system to resolve and inject during attestation initialization
  # Additional ones can be inherited from the specified runner context below
  envAllowList:
    - CUSTOM_VAR
  # Enforce in what runner context the attestation must happen
  # If not specified, the attestation crafting process is allowed to run anywhere
  runner:
    type: "GITHUB_ACTION"

apiVersion: chainloop.dev/v1
kind: Contract
metadata:
  name: my-contract
spec:
  materials:
    - name: sbom-cyclonedx
      type: SBOM_CYCLONEDX_JSON
      group: sbom
    - name: sbom-spdx
      type: SBOM_SPDX_JSON
      group: sbom

apiVersion: chainloop.dev/v1
kind: Contract
metadata:
  name: policy-example-contract
spec:
  materials:
    - name: sbom
      type: SBOM_CYCLONEDX_JSON
    - name: another-sbom
      type: SBOM_CYCLONEDX_JSON
    - name: my-image
      type: CONTAINER_IMAGE
  policies:
    materials: # policies applied to materials
      - ref: file://cyclonedx-licenses.yaml # (1)
    attestation: # policies applied to the whole attestation
      - ref: https://github.com/chainloop/chainloop-dev/blob/main/docs/examples/policies/chainloop-commit.yaml # (2)

- name: Initialize attestation
  run: chainloop attestation init ...
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

attest:
  script:
    - chainloop attestation init ...
  variables:
    CI_JOB_TOKEN: $CI_JOB_TOKEN