You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,13 +11,13 @@
11
11
12
12
## What is it?
13
13
14
-
Chainloop is an open-source software supply chain control plane, a single source of truth for artifacts plus a declarative attestation process.
14
+
Chainloop is an open-source Software Supply Chain control plane, a single source of truth for metadata and artifacts, plus a declarative attestation process.
15
15
16
-
With Chainloop, SecOps teams can declaratively state the attestation and artifacts expectations for their organization’s CI/CD workflows, while also resting assured that the latest standards and best practices are put in place.
16
+
With Chainloop, SecOps teams can declaratively state the pieces of evidence and artifact expectations for their organization’s CI/CD workflows. At the same time, they can rest assured that the metadata will reach the desired destination for storage and analysis, always meeting the latest standards and best practices.
17
17
18
-
Developer teams, on the other hand, do not need to become security experts, the attestation crafting tool will guide them with guardrails and a familiar developer experience.
18
+
On the other hand, developer teams do not need to become security experts. The attestation crafting tool will guide them with guardrails and a familiar developer experience.
19
19
20
-
To learn more about the project motivation please look at [this blog post](https://docs.chainloop.dev/blog/introducing-chainloop) and see it in action in [this video](https://docs.chainloop.dev/blog/software-supply-chain-attestation-easy-way#see-it-in-action).
20
+
To learn more about the project motivation please look at [our documentation](https://docs.chainloop.dev) and see it in action in [this video](https://www.youtube.com/watch?v=GfSR2ZkZ3as).
21
21
22
22
## Getting started
23
23
@@ -87,7 +87,7 @@ Craft and store attestation metadata and artifacts via a single integration poin
87
87
88
88

89
89
90
-
The result is having a SLSA level 3 compliant single Source of truth for artifacts and attestation built on OSS standards such as [Sigstore](https://www.sigstore.dev/), [in-toto](https://in-toto.io/), [SLSA](https://slsa.dev) and [OCI](https://github.com/opencontainers/image-spec/blob/main/spec.md).
90
+
The result is having a SLSA level 3 compliant single Source of truth for metadata, artifacts and attestations built on OSS standards such as [Sigstore](https://www.sigstore.dev/), [in-toto](https://in-toto.io/), [SLSA](https://slsa.dev) and [OCI](https://github.com/opencontainers/image-spec/blob/main/spec.md).
91
91
92
92
Chainloop also makes sure the crafting of artifacts and attestation follows **best practices and meets the requirements** declared in their associated Workflow Contract.
93
93
@@ -101,9 +101,9 @@ You can think of it as an [**API for your organization's Software Supply Chain**
101
101
102
102

103
103
104
-
### Third-Party Integration fan-out
104
+
### We meet you where you are with third-party integrations
105
105
106
-
Operators can set up third-party integrations such as [Dependency-Track](https://docs.chainloop.dev/guides/dependency-track)for SBOM analysis or an OCI registry for storage of the received artifacts and attestation metadata.
106
+
Operators can set up third-party integrations such as [Dependency-Track](https://docs.chainloop.dev/guides/dependency-track), or [Guac](https://docs.chainloop.dev/guides/guac/)for SBOM analysis or a storage backend such as an OCI registry, or cloud blob storage to place the received artifacts, pieces of evidence and attestation metadata.
0 commit comments