[ Web Proxy ]
URL:
Viewing: https://docs.chainloop.dev/get-started/adding-contract [Back]  [Original]
Set Metadata expectations - Chainloop Documentation
Skip to main content
Chainloop Documentation home pagelight logo [light logo]dark logo [dark logo]
Search...
Navigation
Getting Started
Set Metadata expectations
Getting Started

Set Metadata expectations

In the previous step, we performed an attestation process that contained two pieces of evidence, but none of those were required. Now, our Security and Compliance team wants to force us to always provide those pieces of evidence, this is achieved through the definition of contracts. A contract is the interface between development pipelines and the requirements defined by the Security and Compliance teams in the Chainloop Service. It defines the pieces of evidence that are expected to be received as part of the attestation process, as well as some additional constraints, like the type of source (Github, Dagger , etc.) and the policies that must be evaluated.
See our Contracts reference for more information.

Update the contract

Each workflow has attached an empty contract by default, lets update it to require a container image, an SBOM and a vulnerability report.
Click on Update Contract, and change the contract schema to the following:

Initialize an Attestation process

Lets perform another attestation, but note how this time the requirements have changed
Alternatively, you can create the contract on the fly during the attestation process. To do so, you can provide the reference to a remote, or local yaml file containing the contract definition.

Adding materials and pushing the attestation.

Note that the attestation init command output this time includes a section indicating that a CONTAINER_IMAGE is required alongside with SBOM_CYCLONEDX_JSON and SARIF. What would happen if we try to push without adding any material?
We can see that Chainloop expects us, according to the contract, to provide at least the container image reference, and, optionally, its SBOM. Lets add them:

Command Output

Note that we have specified --name container, since thats the material name that the contract expects. You can learn more about the adding materials process in the Adding Materials section.
Now the Software Bill of Materials:

Command Output

And finally a vulnerability report created by grype in SARIF format

Command Output

And now we can push the attestation:
As before, we can see the details of our attestation in Chainloop Platform:
We have successfully created an attestation that matches the contracts expectations.

Next steps

In the next step, well learn how to run additional policies on the provided metadata
Your First Attestation
Set Policies expectations
slackgithubxlinkedinyoutube
Powered byThis documentation is built and hosted on Mintlify, a developer documentation platform
Web Proxy Viewer  |  New URL  |  Original Page