Setup - Chainloop Documentation

Get access to Chainloop

This guide assumes that you have access to a Chainloop Cloud account or to your own Chainloop instance of Chainloop. If you don’t, please contact us, and we’ll get back to you shortly.

Install the Chainloop Command Line Interface (CLI)

The Chainloop CLI is used to send pieces of evidence and attestations to the platform. During this getting started, we’ll use the CLI to perform local attestations first but later in a CI/CD system. To install the latest version for macOS, Linux or Windows (using WSL) just choose one of the following installation method.

Installation Script
Manual Download

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s

Advanced Options

you can install a specific version with

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --version vx.x.x

and customize the install path (default to /usr/local/bin)

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --path /my-path

To install without sudo, provide a user-accessible path:

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --path ~/.local/bin

if cosign is present in your system, in addition to the checksum check, a signature verification will be performed. This behavior can be enforced via the —force-verification flag.

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --force-verification

To install the open-source edition instead:

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --oss

Download the CLI binary directly and verify its SHA256 against the published checksums.txt. Use this when piping a script into bash is not an option, or when binaries need to be validated out-of-band.

v1.81.2

OS	Architecture	Download	SHA256
Linux	Intel (amd64)	chainloop-linux-amd64	`300b9422a1ae90ddae69d2ff31f550c7f021576ad5bbbf44b1c2cd8b2cbf7260`
Linux	ARM64	chainloop-linux-arm64	`4e707a2caa8ca5c15cd2d22eddc66849b4d7c3136ceabe980eeeb423ffa2022f`
macOS	Intel (amd64)	chainloop-darwin-amd64	`343183f4d0cf3a459b8da28706969ed4b4925163c3dd19de339190133b01f376`
macOS	Apple Silicon	chainloop-darwin-arm64	`f20b26c67513b037d1fb9e9b1b51fa508e5ca555dc521e973cff982eaac9d0f5`

Full manifest: checksums.txt · signature bundle · Release notesDownload, verify, and install (linux/amd64 shown — swap chainloop-linux-amd64 for another row from the table above):

VERSION=v1.81.2
BASE=https://chainloop-baafegchfnekdcde.z02.azurefd.net/public/chainloop-platform-cli/$VERSION

# Download the linux/amd64 binary and the checksum manifest
curl -fsSLO "$BASE/chainloop-linux-amd64"
curl -fsSLO "$BASE/checksums.txt"

# Download the signature bundle and confirm the manifest itself came from Chainloop's release pipeline
curl -fsSLO "$BASE/checksums.txt.sigstore.json"
cosign verify-blob   --bundle=checksums.txt.sigstore.json   --certificate-oidc-issuer="https://token.actions.githubusercontent.com"   --certificate-identity-regexp="^https://github.com/chainloop-dev/platform/.github/workflows/release_backend.yml@"   checksums.txt

# Verify the binary against the manifest
sha256sum --ignore-missing -c checksums.txt
# on macOS: shasum -a 256 --ignore-missing -c checksums.txt

# Install it onto your PATH
chmod +x chainloop-linux-amd64
sudo mv chainloop-linux-amd64 /usr/local/bin/chainloop

v1.81.1

OS	Architecture	Download	SHA256
Linux	Intel (amd64)	chainloop-linux-amd64	`e61200bc47fd9587baf3f3683bda02a9ea442da02b3546b37a574fce724a204b`
Linux	ARM64	chainloop-linux-arm64	`3eda6c3e4631d1aa060a795530497a09ce047fe514ca4d9520b3385a63e42dec`
macOS	Intel (amd64)	chainloop-darwin-amd64	`9b71653cff5a2d086be0882bee4aad68f721047593397788b9e16a0f9a1ad179`
macOS	Apple Silicon	chainloop-darwin-arm64	`7119fca6f9a418c375e7c8be72e5de4371467d8f37d079b189ac7c95eb7efba4`

Full manifest: checksums.txt · signature bundle · Release notesDownload, verify, and install (linux/amd64 shown — swap chainloop-linux-amd64 for another row from the table above):

VERSION=v1.81.1
BASE=https://chainloop-baafegchfnekdcde.z02.azurefd.net/public/chainloop-platform-cli/$VERSION

# Download the linux/amd64 binary and the checksum manifest
curl -fsSLO "$BASE/chainloop-linux-amd64"
curl -fsSLO "$BASE/checksums.txt"

# Download the signature bundle and confirm the manifest itself came from Chainloop's release pipeline
curl -fsSLO "$BASE/checksums.txt.sigstore.json"
cosign verify-blob \
  --bundle=checksums.txt.sigstore.json \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  --certificate-identity-regexp="^https://github.com/chainloop-dev/platform/\.github/workflows/release_backend\.yml@" \
  checksums.txt

# Verify the binary against the manifest
sha256sum --ignore-missing -c checksums.txt
# on macOS: shasum -a 256 --ignore-missing -c checksums.txt

# Install it onto your PATH
chmod +x chainloop-linux-amd64
sudo mv chainloop-linux-amd64 /usr/local/bin/chainloop

v1.81.0

OS	Architecture	Download	SHA256
Linux	Intel (amd64)	chainloop-linux-amd64	`82a5c0d06c7e86327ca116557432c3fa45f6fea246851fce44e7b879718e2b1d`
Linux	ARM64	chainloop-linux-arm64	`1513dc3f302200710d8277d35cdc32ae5d8dafbdbeec842034df070ba2dd8885`
macOS	Intel (amd64)	chainloop-darwin-amd64	`0a61b1c53f9ca4c32e53e83bdfaba05f1dd8c72c45403d9f18029248c36a0ee5`
macOS	Apple Silicon	chainloop-darwin-arm64	`190f9f6144a23b035618072733aad932cab1d1a837e978d104f9d0a8fd7daeb4`