NameIDDescription
Artifact TypeARTIFACTIt represents a software artifact.
AttestationATTESTATIONExisting Chainloop attestations.
BlackDuck SCABLACKDUCK_SCA_JSON
Container Image ReferenceCONTAINER_IMAGEA reference to a container image. It will get resolved and referenced by its sha
CSAF Informational AdvisoryCSAF_INFORMATIONAL_ADVISORY
CSAF Security AdvisoryCSAF_SECURITY_ADVISORY
CSAF Security Incident ReportCSAF_SECURITY_INCIDENT_RESPONSE
CSAF VEXCSAF_VEX
Custom Evidence TypeEVIDENCECustom piece of evidence that doesn’t fit in any other category, for instance, an approval report in json format, etc.
GitHub Advanced Security Code scansGHAS_CODE_SCAN
GitHub Advanced Security Dependency scansGHAS_DEPENDENCY_SCAN
GitHub Advanced Security Secret scansGHAS_SECRET_SCAN
Gitlab Security reportGITLAB_SECURITY_REPORTGitlab Security reports in JSON format
Helm ChartHELM_CHARTA released Helm chart in tarball format
JaCoCo XML ReportJACOCO_XML
JUnitJUNIT_XML
OpenVEXOPENVEXOpen Vulnerability and Exposure eXchange (OpenVEX) format
SARIFSARIF
CycloneDX SBOMSBOM_CYCLONEDX_JSONA CycloneDX Software Bill of Materials (SBOM) in JSON format
SPDX SBOMSBOM_SPDX_JSONAn SPDX Software Bill of Materials (SBOM) in JSON format
Key-Value metadata pairsSTRING
PrismaCloud Twistcli ScanTWISTCLI_SCAN_JSON
ZAP DAST zip reportZAP_DAST_ZIPZap DAST report in zip format that matches the format returned from Zap’s GitHub Action

See below an example on how to use them in your contract or refer to this guide to learn more about how to use them.

skynet.contract.yaml
schemaVersion: v1
# Arbitrary set of annotations can be added to the contract and will be part of the attestation
annotations:
  - name: version
    value: oss # if the value is left empty, it will be required and resolved at attestation time

# https://docs.chainloop.dev/concepts/operator/material-types
materials:
  # CONTAINER_IMAGE kinds will get resolved to retrieve their repository digest
  - type: CONTAINER_IMAGE
    name:
      skynet-control-plane
      # The output flag indicates that the material will be part of the attestation subject
    output: true
    # Arbitrary annotations can be added to the material
    annotations:
      - name: component
        value: control-plane
      # The value can be left empty so it can be provided at attestation time
      - name: asset
  # ARTIFACT kinds will first get uploaded to your artifact registry via the built-in Content Addressable Storage (CAS)
  # Optional dockerfile
  - type: ARTIFACT
    name: dockerfile
    optional: true
  # SBOMs will be uploaded to the artifact registry and referenced in the attestation
  # Both SBOM_CYCLONEDX_JSON and SBOM_SPDX_JSON are supported
  - type: SBOM_CYCLONEDX_JSON
    name: skynet-sbom
  # CSAF_VEX and OPENVEX are supported
  - type: OPENVEX
    name: disclosure
  # And static analysis reports in SARIF format
  - type: SARIF
    name: static-out
  # or additional tools
  - type: TWISTCLI_SCAN_JSON
    name: scan-result

# https://docs.chainloop.dev/concepts/policies
policies:
  materials: # policies applied to materials
    - ref: file://cyclonedx-licenses.yaml 
  attestation: # policies applied to the whole attestation
    - ref: https://github.com/chainloop/chainloop-dev/blob/main/docs/examples/policies/chainloop-commit.yaml # (2)

# Env vars we want the system to resolve and inject during attestation initialization
# Additional ones can be inherited from the specified runner context below
envAllowList:
  - CUSTOM_VAR

# Enforce in what runner context the attestation must happen
# If not specified, the attestation crafting process is allowed to run anywhere
runner:
  type: "GITHUB_ACTION"

Was this page helpful?