macOS
Homebrewverifiziert · 100%
brew install chainloop-clilocal Homebrew formula metadata
brew
chainloop-cli mit Homebrew installieren
Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für chainloop-cli in AI-Agent-Workflows.
Installation
Weitere Installationsbefehle
Überblick
Paketzusammenfassung
CLI for interacting with Chainloop
Projektlinks
Befehle und Aliase
- chainloop
Verlauf
Projektgeschichte und Nutzung
Chainloop CLI is the developer-facing command-line interface for Chainloop's software supply-chain evidence store and attestation platform. It is used to initialize attestations, add evidence such as SBOMs or vulnerability reports, sign metadata, and push it into Chainloop for validation and storage.
Projektgeschichte
Chainloop was introduced on May 22, 2023 as an API for an organization's software supply chain, built around a SLSA level 3 provenance-compliant control plane and a contract-based attestation process. The README describes Chainloop as an open-source evidence store for attestations, SBOMs, VEX, SARIF, QA reports, and related software-delivery evidence.
Adoptionsgeschichte
The official README and docs emphasize use across CI/CD pipelines, with developers using the CLI while security and compliance teams define workflow contracts, policies, storage, and integrations. Chainloop documentation and changelogs show the platform expanding from attestation capture into policies, compliance frameworks, vulnerability management, integrations, AI coding-session evidence, and enterprise platform features.
Wie es verwendet wird
The quickstart guides users through installing the CLI, logging in, initializing an attestation, adding a container image, SBOM, and vulnerability report, then pushing the signed attestation. The CLI reference documents commands for applying YAML resources, uploading/downloading artifacts, creating attestations, and passing configuration through ~/.config/chainloop/config.toml or environment variables such as CHAINLOOP_TOKEN.
Warum Paket-Nerds sich dafür interessieren
Package nerds care about chainloop-cli because it is a modern supply-chain CLI that wraps several packaging-era concerns: SBOMs, provenance, signatures, OCI storage, SLSA, in-toto, Sigstore, policy-as-code, and CI/CD evidence capture. Homebrew packaging gives developers a local install path for a tool meant to be embedded in automated delivery pipelines.
Zeitleiste
- 2023: Chainloop was introduced publicly as an early-access software supply-chain attestation platform.
- 2024: Chainloop changelogs added contract-less attestations, material auto-discovery, broader evidence types, policies, and Prometheus-oriented monitoring.
- 2026: Documentation presents Chainloop as a centralized evidence store with real-time visibility, automated compliance, policy evaluation, and CLI-driven attestation workflows.
Related projects
- Chainloop is built around or integrates with SLSA, in-toto, Sigstore, OCI registries, OPA/Rego policies, Dependency-Track, GUAC, CycloneDX, SPDX, OpenVEX, SARIF, CSAF, GitHub Actions, GitLab CI, and Kubernetes/Helm deployment paths.
Quellen
Sicherheitslage
Noch keine Protected-Tool-Abdeckung gefunden
Für chainloop-cli wurde kein passendes lokales Secret-Handling-Manifest gefunden. Nucleus-Paketmetadaten bleiben hier veröffentlicht, damit künftige Abdeckung eine stabile Paket-URL hat.
Installationsverhalten
- In den Formelmetadaten ist kein Homebrew-Post-install-Hook erfasst.
- Homebrew-Bottle-Metadaten sind für 6 Plattformziele verfügbar.
- Build-Metadaten listen 1 Build-Abhängigkeiten.
Empfohlene Prüfung
Prüfe vor unbeaufsichtigter Agent-Nutzung, ob das Tool Klartext-Credentials liest, Remote-Zustand schreibt, Artefakte veröffentlicht oder Plugins ausführt.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Configuration files
Config paths the tool may read or write during local use.
- Unix
~/.config/chainloop/config.toml
Credential files
Credential-bearing paths to review before unattended agent runs.
- Unix
~/.config/chainloop/config.toml
Executables
Installierte Executables
| Befehl | Art | Sichtbarkeit | Hinweis |
|---|---|---|---|
chainloop | cli | globales Executable |
Aktualität
Version und Aktualität
Diese Signale trennen das Alter der Seitengenerierung, Aktivität des Paketmanagers und Upstream-Release-Vergleich. Versionsrückstand wird nur gemeldet, wenn eine Evidenz-URL und vergleichbare Versionen vorhanden sind.
Seite generiert2026-07-25
Manager-Version1.104.7
Manager aktualisiert2026-07-23
lokale DatenOK
Upstreamaktuell
neueste erkannte Versionv1.104.7
https://github.com/chainloop-dev/chainloop
- OKEs wurden keine Aktualitätswarnungen generiert.
Installationsmetadaten
Paketmetadaten
| Paketschlüssel | brew:chainloop-cli |
|---|---|
| Version | 1.104.7 |
| Paketmanager | Homebrew |
| Paketmanager-Seite | https://formulae.brew.sh/formula/chainloop-cli |
| Homepage | https://docs.chainloop.dev |
| Repository | https://github.com/chainloop-dev/chainloop |
| Upstream-Dokumentation | https://docs.chainloop.dev/ |
| Lizenz | Apache-2.0 |
| Quellarchiv | https://github.com/chainloop-dev/chainloop/archive/refs/tags/v1.104.7.tar.gz |
| Zuletzt aktualisiert | 2026-07-23T15:39:01Z |
| Pulse | updated |
| Build-Abhängigkeiten | go |
| Bottle | verfügbar (auf arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| Homebrew post-install | nicht definiert |
| Dienst | keiner deklariert |
Registry-Fakten
Details aus der Quelldatenbank
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | chainloop-cli |
| Version Scheme | 0 |
| Revision | 0 |
| Head Version | HEAD |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
Quellspur
Aus Repository-Daten generiert
Diese Seite wird von av-web aus dem privaten Paket-SQLite-Artefakt bereitgestellt, das scripts/generate-pkg-sqlite.py erstellt.
Combined YAML source
View the package source record on GitHub.
Verwendete Quellen
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated configuration and credential file locations
- curated package history
- package relationship graph
- package version freshness
- package-page enrichment