Chainloop, A Software Supply Chain Attestation solution devs won't hate
Hi, my name is Miguel and I am very happy to share what's been months worth of work :) The project has rough edges for sure, but any early feedback, comments or concerns are appreciated! === The Problem === You work on the Security and Operations (SecOps) team in charge of your organization's Software Supply Chain Security. You feel pretty good about the state of things already, your developer teams are signing their commits, deliverables, scanning for vulnerabilities,… Life is good! Then you realize that you are not compliant with the latest security requirements. You get referred to…
In plain words
Chainloop is a software supply chain attestation solution that helps organizations achieve security compliance requirements like SLSA level 3. It enables development and security teams to document and verify the integrity of their software delivery process through attestation and artifact management. The tool is designed for adoption by developer teams, focusing on making compliance accessible rather than burdensome.
written from the facts on this page · September 2026
From the sources
In the maker’s words, at launch
Hi, my name is Miguel and I am very happy to share what's been months worth of work :) The project has rough edges for sure, but any early feedback, comments or concerns are appreciated! === The Problem === You work on the Security and Operations (SecOps) team in charge of your organization's Software Supply Chain Security. You feel pretty good about the state of things already, your developer teams are signing their commits, deliverables, scanning for vulnerabilities,… Life is good! Then you realize that you are not compliant with the latest security requirements. You get referred to slsa.dev and are told that you need to be at least level 3, whatever that means! Aha! I “just” need to implement an attestation and artifact layer in our Software Supply Chain, which you complete after a couple of months of work. Now to the easy part (or what you think). To make the developer teams adopt it. You quickly realize that standardizing best practices and security requirements is very hard. Development and SecOps team dynamics are clashy and poorly defined due to priorities mismatch. Also, from the developer's point of view, it’s very time-consuming and frustrating to pollute your CI/CD systems with convoluted, error-prone and complex processes to comply with the SecOps team. So there has to be a better way that satisfies both sides... === The Solution === Enter Chainloop. You can think of it as an API for your organization's Software Supply Chain that both parties can use to interact effectively to meet their mismatched priorities. SecOps teams regain security compliance, visibility, standardization and control by having a mechanism to define and propagate attestation requirements. Developers, on the other hand, get jargon-free tooling that can be used to meet compliance with minimum friction and effort. === Give it a try === Eager for feedback from the community so please reach out. Happy to chat! Thanks! PS: You can see an attestation end-to-end demo here https://www.youtube.com/watch?v=Q_0dlBqKtIU&t=384s
More dev tools this month
the category →
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 1d ago · opentrailpaper.com
Launched alongside, March 2023
the whole month →
- BI
I'm a big fan of the BBC podcast In Our Time -- and (like most people) I've been playing with the OpenAI APIs. In Our Time has almost 1,000 episodes on everything from Cleopatra to the evolution of teeth to plasma physics, all still available, so it's my starting point to learn about most topics. But it's not well organised. So here are the episodes sorted by library code. It's fun to explore. Web scraping is usually pretty tedious, but I found that I could send the minimised HTML to GPT-3 and get (almost) perfect JSON back: the prompt includes the Typescript definition. At the same time I…
AI · 2023 · genmon.github.io