Keyless Attestations in GitLab

This feature is only available on Chainloop’s platform paid plans.

You can now perform attestations from GitLab runners without the need to use Chainloop API tokens. In addition to the benefit of not having to manage API tokens, this also allows you to enable SLSA 3 compliance checks by default. To achieve this you’ll need to:

Connect your GitLab repository to a project
Send GitLab token during the attestation process

1 - Connect your GitLab repository to a project

Before attesting, connect the Chainloop GitLab integration and link the repository to a project:

Connect GitHub & GitLab — one-time organization setup.
Create a project — link the repository to the project that will receive attestations.

Attestations from repositories that are not connected to a project will not be accepted.

2 - Send GitLab token during the attestation process

You are now ready to leverage GitLab’s OIDC tokens from your pipelines. The requirement is to create an ID token that has the chainloop audience. To achieve this in GitLab, you can add the following snippet to your pipeline yaml file.

id_tokens:
  CHAINLOOP_TOKEN:
    aud: chainloop # make sure the audience is chainloop

A full pipeline example could look like

stages:
  - build

build-job: 
  stage: build
  id_tokens:
    CHAINLOOP_TOKEN:
      aud: chainloop
  script:
    - curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s
    - chainloop att init --workflow test-gitlab --project demo
    - chainloop attestation push
  after_script:
    - chainloop attestation reset || true

Note that if you have onboarded the same repository to more than one Chainloop organization, you’ll need to pass the —org flag to the init command, for example.

chainloop att init --workflow test-gitlab --project demo --org my-org

Keyless Attestations in GitHub Use Keyfactor SignServer for attestation signing

Getting Started

Concepts

Guides

References

Misc

1 - Connect your GitLab repository to a project

2 - Send GitLab token during the attestation process

​1 - Connect your GitLab repository to a project

​2 - Send GitLab token during the attestation process

1 - Connect your GitLab repository to a project

2 - Send GitLab token during the attestation process