Setup

Get access to Chainloop

This guide assumes that you have access to a Chainloop Cloud account or to your own self-hosted Chainloop instance. If you don’t, you can sign up for Chainloop Cloud, or contact us if you’d rather run Chainloop yourself.

Install the Chainloop Command Line Interface (CLI)

The Chainloop CLI is used to send pieces of evidence and attestations to the platform. During this getting started, we’ll use the CLI to perform attestations locally first, and later in a CI/CD system. To install the latest version for macOS, Linux, or Windows (using WSL), choose one of the following installation methods.

Chainloop SaaS
On-Prem
Manual Download

The install script comes pre-configured for Chainloop Cloud.

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s

Advanced Options

you can install a specific version with

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --version vx.x.x

and customize the install path (defaults to /usr/local/bin)

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --path /my-path

To install without sudo, provide a user-accessible path:

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --path ~/.local/bin

if cosign is present in your system, in addition to the checksum check, a signature verification will be performed. This behavior can be enforced via the —force-verification flag.

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --force-verification

To install the open-source edition instead:

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --oss

Two things have to be true before the CLI can talk to your instance: the binary is installed, and it points at your instance’s endpoints. Installing from your own instance’s domain does both in a single command.

Download and configure the CLI

Install from your own instance’s domain and the CLI is automatically configured to talk to it — there is nothing else to set up. Copy the exact command from the Chainloop web UI — click the terminal (>_) icon in the top-right corner — or replace YOUR_INSTANCE_DOMAIN below with your own.

curl -sfL https://YOUR_INSTANCE_DOMAIN/cli/install.sh | bash -s

Terminal icon in the top-right corner of the Chainloop web UI that opens the CLI installation dialog

Advanced Options

you can install a specific version with

curl -sfL https://YOUR_INSTANCE_DOMAIN/cli/install.sh | bash -s -- --version vx.x.x

and customize the install path (defaults to /usr/local/bin)

curl -sfL https://YOUR_INSTANCE_DOMAIN/cli/install.sh | bash -s -- --path /my-path

To install without sudo, provide a user-accessible path:

curl -sfL https://YOUR_INSTANCE_DOMAIN/cli/install.sh | bash -s -- --path ~/.local/bin

if cosign is present in your system, in addition to the checksum check, a signature verification will be performed. This behavior can be enforced via the —force-verification flag.

curl -sfL https://YOUR_INSTANCE_DOMAIN/cli/install.sh | bash -s -- --force-verification

To install the open-source edition instead:

curl -sfL https://YOUR_INSTANCE_DOMAIN/cli/install.sh | bash -s -- --oss

Point the CLI at your instance — only if you installed it another way

Skip this if you used the command above. Run it when the CLI came from somewhere else — dl.chainloop.dev, a package manager, or a Manual Download — or when you want to switch an existing install to a different instance.

chainloop config save \
  --control-plane my-controlplane.acme.com:443 \
  --artifact-cas cas.acme.com:443 \
  --platform my-platform.acme.com:443

Confirm which instance the CLI is talking to with chainloop config view.

Download the CLI binary directly and verify its SHA256 against the published checksums.txt. Use this when piping a script into bash is not an option, or when binaries need to be validated out-of-band.

v1.141.0

OS	Architecture	Download	SHA256
Linux	Intel (amd64)	chainloop-linux-amd64	`29c106f0f0aab5bb2c2ecf614105daa9975e3cfcc0be01f3a32d059acbbcfb0c`
Linux	ARM64	chainloop-linux-arm64	`fee123ee097d85e1a9fb34ce7639b1e25e6d10b8d8935c4a3a57ad4907cc086b`
macOS	Intel (amd64)	chainloop-darwin-amd64	`0bc95d872bf6ec7202a7dd78ec3254f32246b5c867e0bb137a56e41c79ddd10a`
macOS	Apple Silicon	chainloop-darwin-arm64	`0181b81153c5ac1411ed88613d71dc92ec58ee5ce7e602576e18a4db680839c7`
Windows	Intel (amd64)	chainloop-windows-amd64.exe	`9342a7e389e573039c951bf121d663838a8a9696f1450fdeaa2d342adb48d03e`
Windows	ARM64	chainloop-windows-arm64.exe	`61f7ddf59350e320bb9c7c9a1b2902459e15d68bed3f2fbaa7e3b81ed96a4996`

Full manifest: checksums.txt · signature bundle · Release notesDownload, verify, and install (linux/amd64 shown — swap chainloop-linux-amd64 for another row from the table above):

VERSION=v1.141.0
BASE=https://chainloop-baafegchfnekdcde.z02.azurefd.net/public/chainloop-platform-cli/$VERSION

# Download the linux/amd64 binary and the checksum manifest
curl -fsSLO "$BASE/chainloop-linux-amd64"
curl -fsSLO "$BASE/checksums.txt"

# Download the signature bundle and confirm the manifest itself came from Chainloop's release pipeline
curl -fsSLO "$BASE/checksums.txt.sigstore.json"
cosign verify-blob \
  --bundle=checksums.txt.sigstore.json \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  --certificate-identity-regexp="^https://github.com/chainloop-dev/platform/\.github/workflows/release_backend\.yml@" \
  checksums.txt

# Verify the binary against the manifest
sha256sum --ignore-missing -c checksums.txt
# on macOS: shasum -a 256 --ignore-missing -c checksums.txt

# Install it onto your PATH
chmod +x chainloop-linux-amd64
sudo mv chainloop-linux-amd64 /usr/local/bin/chainloop

Unlike the install script, a manually downloaded binary isn’t automatically configured for your instance. If you’re on an on-prem or dedicated instance, point the CLI at your instance’s endpoints (Chainloop SaaS users can skip this):

chainloop config save \
  --control-plane my-controlplane.acme.com:443 \
  --artifact-cas cas.acme.com:443 \
  --platform my-platform.acme.com:443

Getting Started

Concepts

Guides

References

Misc

Get access to Chainloop

Install the Chainloop Command Line Interface (CLI)

​Get access to Chainloop

​Install the Chainloop Command Line Interface (CLI)

Get access to Chainloop

Install the Chainloop Command Line Interface (CLI)