Reference on

Chainguard Libraries network requirements

Wed, 04 Jun 2025 09:30:00 +0000

Chainguard Libraries require specific network access to ensure secure delivery of hardened dependencies to your development environment. This guide details the domains and ports needed for authentication, package downloads, and verification tools.

Access for chainctl and other tools

For initial configuration with chainctl as well as for verification of downloaded libraries with cosign and other tools, you must allow HTTPS access to the following domains:

Alpine Compatibility

Fri, 23 Feb 2024 15:56:52 -0700

Chainguard Containers and Alpine base images have different binaries and scripts included in their respective busybox and coreutils packages.

The following table lists common tools and their corresponding package(s) in both Wolfi and Alpine distributions.

Note that $PATH locations like /usr/bin or /sbin are not included here. If you have compatibility issues with tools that are included in both busybox and coreutils, be sure to check $PATH order and confirm which version of a tool is being run.

Chainguard Events

Tue, 15 Nov 2022 12:05:04 +0000

Chainguard generates and emits CloudEvents based on actions that occur within a Chainguard account, such as registering a Kubernetes cluster or creating an IAM invitation. Chainguard also emits events when workloads or policies are changed in a cluster.

Check out this GitHub repository for some sample applications that demonstrate how to use events to create Slack notifications, open GitHub issues, and mirror images.

To subscribe to Chainguard events for your account, use the chainctl command like this:

Overview of the Chainguard IAM Model

Fri, 15 Jul 2022 15:22:20 +0100

Chainguard’s Identity and Access Management (IAM) model enables more secure, fine-grained control over container registries and security resources, using familiar concepts from cloud providers like AWS and GCP. This enterprise-grade IAM system allows organizations to implement least-privilege access, delegate permissions, and integrate with existing identity providers for seamless authentication and authorization.

Organizations and Folders

Chainguard’s IAM model consists of two structures: Organizations and Folders. An organization is a customer or group of customers working with the same Chainguard resources, while a folder is a collection of resources within a Chainguard organization.

Built-in Roles and Capabilities Reference

Thu, 14 Aug 2025 00:00:00 +0000

Chainguard provides customers with a set of built-in roles as part of its Identity and Access Management (IAM) system. These roles have different permissions and capabilities that allow them to serve specialized purposes, from general administrative access to access for specific resources like registries, APK packages, and programming language libraries.

This reference provides an overview of all Chainguard IAM capabilities and shows which built-in roles include each capability. Each capability represents a specific permission or action that can be performed within the Chainguard platform.

Debian compatibility

Thu, 08 Feb 2024 15:56:52 -0700

Chainguard Containers and Debian base images have different binaries and scripts included in their respective busybox and coreutils packages.

The following table lists common tools and their corresponding package(s) in both Wolfi and Debian distributions.

Chainguard Containers Network Requirements

Fri, 08 Sep 2023 08:49:31 +0000

This document provides an overview of network requirements for using Chainguard Containers. To use Chainguard tools and Containers in environments with firewalls, VPNs, and IDS/IPS systems, you will need to add some rules to allow traffic into and out of your networks.

Chainguard Containers do not call Chainguard services while running, so no network changes would be required to the runtime environment. Review the Notes column for more info on each Hostname.

Rego Policies

Thu, 12 Jan 2023 15:56:52 -0700

The Sigstore Policy Controller supports the Rego Policy Language, which is a declarative policy language that is used to evaluate structured input data such as Kubernetes manifests and JSON documents. This feature enables users to apply policies that can evaluate Kubernetes admission requests and object metadata to make comprehensive decisions about the workloads that are admitted to their clusters. Rego support also enables users to enhance existing cloud-native policies by adding additional software supply chain security checks.

CISA Secure Software Development Attestation Form (Draft)

Wed, 10 May 2023 15:21:01 +0200

Attestation and Signature

On behalf of the above-specified company, I attest that [software producer] presently makes consistent use of the following practices, drawn from the secure software development framework (SSDF), in developing the software identified in Section I:

Ubuntu Compatibility

Fri, 23 Feb 2024 15:56:52 -0700

Chainguard Containers and Ubuntu base images have different binaries and scripts included in their respective busybox and coreutils packages.

The following table lists common tools and their corresponding package(s) in both Wolfi and Ubuntu distributions.

Secure Software Development Framework (SSDF) Table, NIST SP 800-218

Wed, 10 May 2023 15:21:01 +0200

SSDF Table

Practices	Tasks	Notional Implementation Examples	References
Define Security Requirements for Software Development (PO.1): Ensure that security requirements for software development are known at all times so that they can be taken into account throughout the SDLC and duplication of effort can be minimized because the requirements information can be collected once and shared. This includes requirements from internal sources (e.g., the organization’s policies, business objectives, and risk management strategy) and external sources (e.g., applicable laws and regulations).	PO.1.1: Identify and document all security requirements for the organization’s software development infrastructures and processes, and maintain the requirements over time.	Example 1: Define policies for securing software development infrastructures and their components, including development endpoints, throughout the SDLC and maintaining that security. Example 2: Define policies for securing software development processes throughout the SDLC and maintaining that security, including for open-source and other third-party software components utilized by software being developed. Example 3: Review and update security requirements at least annually, or sooner if there are new requirements from internal or external sources, or a major security incident targeting software development infrastructure has occurred. Example 4: Educate affected individuals on impending changes to requirements.	BSAFSS: SM.3, DE.1, IA.1, IA.2 BSIMM: CP1.1, CP1.3, SR1.1, SR2.2, SE1.2, SE2.6 EO14028: 4e(ix) IEC62443: SM-7, SM-9 NISTCSF: ID.GV-3 OWASPASVS: 1.1.1 OWASPMASVS: 1.10 OWASPSAMM: PC1-A, PC1-B, PC2-A PCISSLC: 2.1, 2.2 SCFPSSD: Planning the Implementation and Deployment of Secure Development Practices SP80053: SA-1, SA-8, SA-15, SR-3 SP800160: 3.1.2, 3.2.1, 3.2.2, 3.3.1, 3.4.2, 3.4.3 SP800161: SA-1, SA-8, SA-15, SR-3 SP800181: T0414; K0003, K0039, K0044, K0157, K0168, K0177, K0211, K0260, K0261, K0262, K0524; S0010, S0357, S0368; A0033, A0123, A0151
	PO.1.2: Identify and document all security requirements for organization-developed software to meet, and maintain the requirements over time.	Example 1: Define policies that specify risk-based software architecture and design requirements, such as making code modular to facilitate code reuse and updates; isolating security components from other components during execution; avoiding undocumented commands and settings; and providing features that will aid software acquirers with the secure deployment, operation, and maintenance of the software. Example 2: Define policies that specify the security requirements for the organization’s software, and verify compliance at key points in the SDLC (e.g., classes of software flaws verified by gates, responses to vulnerabilities discovered in released software). Example 3: Analyze the risk of applicable technology stacks (e.g., languages, environments, deployment models), and recommend or require the use of stacks that will reduce risk compared to others. Example 4: Define policies that specify what needs to be archived for each software release (e.g., code, package files, third-party libraries, documentation, data inventory) and how long it needs to be retained based on the SDLC model, software end-of-life, and other factors. Example 5: Ensure that policies cover the entire software life cycle, including notifying users of the impending end of software support and the date of software end-of-life. Example 6: Review all security requirements at least annually, or sooner if there are new requirements from internal or external sources, a major vulnerability is discovered in released software, or a major security incident targeting organization-developed software has occurred. Example 7: Establish and follow processes for handling requirement exception requests, including periodic reviews of all approved exceptions.	BSAFSS: SC.1-1, SC.2, PD.1-1, PD.1-2, PD.1-3, PD.2-2, SI, PA, CS, AA, LO, EE BSIMM: SM1.1, SM1.4, SM2.2, CP1.1, CP1.2, CP1.3, CP2.1, CP2.3, AM1.2, SFD1.1, SFD2.1, SFD3.2, SR1.1, SR1.3, SR2.2, SR3.3, SR3.4 EO14028: 4e(ix) IEC62443: SR-3, SR-4, SR-5, SD-4 ISO27034: 7.3.2 MSSDL: 2, 5 NISTCSF: ID.GV-3 OWASPMASVS: 1.12 OWASPSAMM: PC1-A, PC1-B, PC2-A, PC3-A, SR1-A, SR1-B, SR2-B, SA1-B, IR1-A PCISSLC: 2.1, 2.2, 2.3, 3.3 SCFPSSD: Establish Coding Standards and Conventions SP80053: SA-8, SA-8(3), SA-15, SR-3 SP800160: 3.1.2, 3.2.1, 3.3.1 SP800161: SA-8, SA-15, SR-3 SP800181: T0414; K0003, K0039, K0044, K0157, K0168, K0177, K0211, K0260, K0261, K0262, K0524; S0010, S0357, S0368; A0033, A0123, A0151
	PO.1.3: Communicate requirements to all third parties who will provide commercial software components to the organization for reuse by the organization’s own software. [Formerly PW.3.1]	Example 1: Define a core set of security requirements for software components, and include it in acquisition documents, software contracts, and other agreements with third parties. Example 2: Define security-related criteria for selecting software; the criteria can include the third party’s vulnerability disclosure program and product security incident response capabilities or the third party’s adherence to organization-defined practices. Example 3: Require third parties to attest that their software complies with the organization’s security requirements. Example 4: Require third parties to provide provenance data and integrity verification mechanisms for all components of their software. Example 5: Establish and follow processes to address risk when there are security requirements that third-party software components to be acquired do not meet; this should include periodic reviews of all approved exceptions to requirements.	BSAFSS: SM.1, SM.2, SM.2-1, SM.2-4 BSIMM: CP2.4, CP3.2, SR2.5, SR3.2 EO14028: 4e(vi), 4e(ix) IDASOAR: 19, 21 IEC62443: SM-9, SM-10 MSSDL: 7 NISTCSF: ID.SC-3 OWASPSAMM: SR3-A SCAGILE: Tasks Requiring the Help of Security Experts 8 SCFPSSD: Manage Security Risk Inherent in the Use of Third-Party Components SCSIC: Vendor Sourcing Integrity Controls SP80053: SA-4, SA-9, SA-10, SA-10(1), SA-15, SR-3, SR-4, SR-5 SP800160: 3.1.1, 3.1.2 SP800161: SA-4, SA-9, SA-9(1), SA-9(3), SA-10, SA-10(1), SA-15, SR-3, SR-4, SR-5 SP800181: T0203, T0415; K0039; S0374; A0056, A0161
Implement Roles and Responsibilities (PO.2): Ensure that everyone inside and outside of the organization involved in the SDLC is prepared to perform their SDLC-related roles and responsibilities throughout the SDLC.	PO.2.1: Create new roles and alter responsibilities for existing roles as needed to encompass all parts of the SDLC. Periodically review and maintain the defined roles and responsibilities, updating them as needed.	Example 1: Define SDLC-related roles and responsibilities for all members of the software development team. Example 2: Integrate the security roles into the software development team. Example 3: Define roles and responsibilities for cybersecurity staff, security champions, project managers and leads, senior management, software developers, software testers, software assurance leads and staff, product owners, operations and platform engineers, and others involved in the SDLC. Example 4: Conduct an annual review of all roles and responsibilities. Example 5: Educate affected individuals on impending changes to roles and responsibilities, and confirm that the individuals understand the changes and agree to follow them. Example 6: Implement and use tools and processes to promote communication and engagement among individuals with SDLC-related roles and responsibilities, such as creating messaging channels for team discussions. Example 7: Designate a group of individuals or a team as the code owner for each project.	BSAFSS: PD.2-1, PD.2-2 BSIMM: SM1.1, SM2.3, SM2.7, CR1.7 EO14028: 4e(ix) IEC62443: SM-2, SM-13 NISTCSF: ID.AM-6, ID.GV-2 PCISSLC: 1.2 SCSIC: Vendor Software Development Integrity Controls SP80053: SA-3 SP800160: 3.2.1, 3.2.4, 3.3.1 SP800161: SA-3 SP800181: K0233
	PO.2.2: Provide role-based training for all personnel with responsibilities that contribute to secure development. Periodically review personnel proficiency and role-based training, and update the training as needed.	Example 1: Document the desired outcomes of training for each role. Example 2: Define the type of training or curriculum required to achieve the desired outcome for each role. Example 3: Create a training plan for each role. Example 4: Acquire or create training for each role; acquired training may need to be customized for the organization. Example 5: Measure outcome performance to identify areas where changes to training may be beneficial.	BSAFSS: PD.2-2 BSIMM: T1.1, T1.7, T1.8, T2.5, T2.8, T2.9, T3.1, T3.2, T3.4 EO14028: 4e(ix) IEC62443: SM-4 MSSDL: 1 NISTCSF: PR.AT OWASPSAMM: EG1-A, EG2-A PCISSLC: 1.3 SCAGILE: Operational Security Tasks 14, 15; Tasks Requiring the Help of Security Experts 1 SCFPSSD: Planning the Implementation and Deployment of Secure Development Practices SCSIC: Vendor Software Development Integrity Controls SP80053: SA-8 SP800160: 3.2.4, 3.2.6 SP800161: SA-8 SP800181: OV-TEA-001, OV-TEA-002; T0030, T0073, T0320; K0204, K0208, K0220, K0226, K0243, K0245, K0252; S0100, S0101; A0004, A0057
	PO.2.3: Obtain upper management or authorizing official commitment to secure development, and convey that commitment to all with development-related roles and responsibilities.	Example 1: Appoint a single leader or leadership team to be responsible for the entire secure software development process, including being accountable for releasing software to production and delegating responsibilities as appropriate. Example 2: Increase authorizing officials’ awareness of the risks of developing software without integrating security throughout the development life cycle and the risk mitigation provided by secure development practices. Example 3: Assist upper management in incorporating secure development support into their communications with personnel with development-related roles and responsibilities. Example 4: Educate all personnel with development-related roles and responsibilities on upper management’s commitment to secure development and the importance of secure development to the organization.	BSIMM: SM1.3, SM2.7, CP2.5 EO14028: 4e(ix) NISTCSF: ID.RM-1, ID.SC-1 OWASPSAMM: SM1.A PCISSLC: 1.1 SP800181: T0001, T0004
Implement Supporting Toolchains (PO.3): Use automation to reduce human effort and improve the accuracy, reproducibility, usability, and comprehensiveness of security practices throughout the SDLC, as well as provide a way to document and demonstrate the use of these practices. Toolchains and tools may be used at different levels of the organization, such as organization-wide or project-specific, and may address a particular part of the SDLC, like a build pipeline.	PO.3.1: Specify which tools or tool types must or should be included in each toolchain to mitigate identified risks, as well as how the toolchain components are to be integrated with each other.	Example 1: Define categories of toolchains, and specify the mandatory tools or tool types to be used for each category. Example 2: Identify security tools to integrate into the developer toolchain. Example 3: Define what information is to be passed between tools and what data formats are to be used. Example 4: Evaluate tools’ signing capabilities to create immutable records/logs for auditability within the toolchain. Example 5: Use automated technology for toolchain management and orchestration.	BSIMM: CR1.4, ST1.4, ST2.5, SE2.7 CNCFSSCP: Securing Materials—Verification; Securing Build Pipelines—Verification, Automation, Secure Authentication/Access; Securing Artefacts—Verification; Securing Deployments—Verification EO14028: 4e(iii), 4e(ix) MSSDL: 8 OWASPSAMM: IR2-B, ST2-B SCAGILE: Tasks Requiring the Help of Security Experts 9 SCSIC: Vendor Software Delivery Integrity Controls SP80053: SA-15 SP800161: SA-15 SP800181: K0013, K0178
	PO.3.2: Follow recommended security practices to deploy, operate, and maintain tools and toolchains.	Example 1: Evaluate, select, and acquire tools, and assess the security of each tool. Example 2: Integrate tools with other tools and existing software development processes and workflows. Example 3: Use code-based configuration for toolchains (e.g., pipelines-as-code, toolchains-as-code). Example 4: Implement the technologies and processes needed for reproducible builds. Example 5: Update, upgrade, or replace tools as needed to address tool vulnerabilities or add new tool capabilities. Example 6: Continuously monitor tools and tool logs for potential operational and security issues, including policy violations and anomalous behavior. Example 7: Regularly verify the integrity and check the provenance of each tool to identify potential problems. Example 8: See PW.6 regarding compiler, interpreter, and build tools. Example 9: See PO.5 regarding implementing and maintaining secure environments.	BSAFSS: DE.2 BSIMM: SR1.1, SR1.3, SR3.4 CNCFSSCP: Securing Build Pipelines—Verification, Automation, Controlled Environments, Secure Authentication/Access; Securing Artefacts—Verification, Automation, Controlled Environments, Encryption; Securing Deployments—Verification, Automation EO14028: 4e(i)(F), 4e(ii), 4e(iii), 4e(v), 4e(vi), 4e(ix) IEC62443: SM-7 IR8397: 2.2 OWASPASVS: 1.14.3, 1.14.4, 14.1, 14.2 OWASPMASVS: 7.9 OWASPSCVS: 3, 5 SCAGILE: Tasks Requiring the Help of Security Experts 9 SCFPSSD: Use Current Compiler and Toolchain Versions and Secure Compiler Options SCSIC: Vendor Software Delivery Integrity Controls SP80053: SA-15 SP800161: SA-15 SP800181: K0013, K0178
	PO.3.3: Configure tools to generate artifacts of their support of secure software development practices as defined by the organization.	Example 1: Use existing tooling (e.g., workflow tracking, issue tracking, value stream mapping) to create an audit trail of the secure development-related actions that are performed for continuous improvement purposes. Example 2: Determine how often the collected information should be audited, and implement the necessary processes. Example 3: Establish and enforce security and retention policies for artifact data. Example 4: Assign responsibility for creating any needed artifacts that tools cannot generate.	BSAFSS: PD.1-5 BSIMM: SM1.4, SM3.4, SR1.3 CNCFSSCP: Securing Build Pipelines—Verification, Automation, Controlled Environments; Securing Artefacts—Verification EO14028: 4e(i)(F), 4e(ii), 4e(v), 4e(ix) IEC62443: SM-12, SI-2 MSSDL: 8 OWASPSAMM: PC3-B OWASPSCVS: 3.13, 3.14 PCISSLC: 2.5 SCAGILE: Tasks Requiring the Help of Security Experts 9 SCSIC: Vendor Software Delivery Integrity Controls SP80053: SA-15 SP800161: SA-15 SP800181: K0013; T0024
Define and Use Criteria for Software Security Checks (PO.4): Help ensure that the software resulting from the SDLC meets the organization’s expectations by defining and using criteria for checking the software’s security during development.	PO.4.1: Define criteria for software security checks and track throughout the SDLC.	Example 1: Ensure that the criteria adequately indicate how effectively security risk is being managed. Example 2: Define key performance indicators (KPIs), key risk indicators (KRIs), vulnerability severity scores, and other measures for software security. Example 3: Add software security criteria to existing checks (e.g., the Definition of Done in agile SDLC methodologies). Example 4: Review the artifacts generated as part of the software development workflow system to determine if they meet the criteria. Example 5: Record security check approvals, rejections, and exception requests as part of the workflow and tracking system. Example 6: Analyze collected data in the context of the security successes and failures of each development project, and use the results to improve the SDLC.	BSAFSS: TV.2-1, TV.5-1 BSIMM: SM1.4, SM2.1, SM2.2, SM2.6, SM3.3, CP2.2 EO14028: 4e(iv), 4e(v), 4e(ix) IEC62443: SI-1, SI-2, SVV-3 ISO27034: 7.3.5 MSSDL: 3 OWASPSAMM: PC3-A, DR3-B, IR3-B, ST3-B PCISSLC: 3.3 SP80053: SA-15, SA-15(1) SP800160: 3.2.1, 3.2.5, 3.3.1 SP800161: SA-15, SA-15(1) SP800181: K0153, K0165
	PO.4.2: Implement processes, mechanisms, etc. to gather and safeguard the necessary information in support of the criteria.	Example 1: Use the toolchain to automatically gather information that informs security decision-making. Example 2: Deploy additional tools if needed to support the generation and collection of information supporting the criteria. Example 3: Automate decision-making processes utilizing the criteria, and periodically review these processes. Example 4: Only allow authorized personnel to access the gathered information, and prevent any alteration or deletion of the information.	BSAFSS: PD.1-4, PD.1-5 BSIMM: SM1.4, SM2.1, SM2.2, SM3.4 EO14028: 4e(iv), 4e(v), 4e(ix) IEC62443: SI-1, SVV-1, SVV-2, SVV-3, SVV-4 OWASPSAMM: PC3-B PCISSLC: 2.5 SCSIC: Vendor Software Delivery Integrity Controls SP80053: SA-15, SA-15(1), SA-15(11) SP800160: 3.2.5, 3.3.7 SP800161: SA-15, SA-15(1), SA-15(11) SP800181: T0349; K0153
Implement and Maintain Secure Environments for Software Development (PO.5): Ensure that all components of the environments for software development are strongly protected from internal and external threats to prevent compromises of the environments or the software being developed or maintained within them. Examples of environments for software development include development, build, test, and distribution environments.	PO.5.1: Separate and protect each environment involved in software development.	Example 1: Use multi-factor, risk-based authentication and conditional access for each environment. Example 2: Use network segmentation and access controls to separate the environments from each other and from production environments, and to separate components from each other within each non-production environment, in order to reduce attack surfaces and attackers’ lateral movement and privilege/access escalation. Example 3: Enforce authentication and tightly restrict connections entering and exiting each software development environment, including minimizing access to the internet to only what is necessary. Example 4: Minimize direct human access to toolchain systems, such as build services. Continuously monitor and audit all access attempts and all use of privileged access. Example 5: Minimize the use of production-environment software and services from non-production environments. Example 6: Regularly log, monitor, and audit trust relationships for authorization and access between the environments and between the components within each environment. Example 7: Continuously log and monitor operations and alerts across all components of the development environment to detect, respond, and recover from attempted and actual cyber incidents. Example 8: Configure security controls and other tools involved in separating and protecting the environments to generate artifacts for their activities. Example 9: Continuously monitor all software deployed in each environment for new vulnerabilities, and respond to vulnerabilities appropriately following a risk-based approach. Example 10: Configure and implement measures to secure the environments’ hosting infrastructures following a zero trust architecture.	BSAFSS: DE.1, IA.1, IA.2 CNCFSSCP: Securing Build Pipelines—Controlled Environments EO14028: 4e(i)(A), 4e(i)(B), 4e(i)(C), 4e(i)(D), 4e(i)(F), 4e(ii), 4e(iii), 4e(v), 4e(vi), 4e(ix) IEC62443: SM-7 NISTCSF: PR.AC-5, PR.DS-7 SCAGILE: Tasks Requiring the Help of Security Experts 11 SCSIC: Vendor Software Delivery Integrity Controls SP80053: SA-3(1), SA-8, SA-15 SP800161: SA-3, SA-8, SA-15 SP800181: OM-NET-001, SP-SYS-001; T0019, T0023, T0144, T0160, T0262, T0438, T0484, T0485, T0553; K0001, K0005, K0007, K0033, K0049, K0056, K0061, K0071, K0104, K0112, K0179, K0326, K0487; S0007, S0084, S0121; A0048
	PO.5.2: Secure and harden development endpoints (i.e., endpoints for software designers, developers, testers, builders, etc.) to perform development-related tasks using a risk-based approach.	Example 1: Configure each development endpoint based on approved hardening guides, checklists, etc.; for example, enable FIPS-compliant encryption of all sensitive data at rest and in transit. Example 2: Configure each development endpoint and the development resources to provide the least functionality needed by users and services and to enforce the principle of least privilege. Example 3: Continuously monitor the security posture of all development endpoints, including monitoring and auditing all use of privileged access. Example 4: Configure security controls and other tools involved in securing and hardening development endpoints to generate artifacts for their activities. Example 5: Require multi-factor authentication for all access to development endpoints and development resources. Example 6: Provide dedicated development endpoints on non-production networks for performing all development-related tasks. Provide separate endpoints on production networks for all other tasks. Example 7: Configure each development endpoint following a zero trust architecture.	BSAFSS: DE.1-1, IA.1, IA.2 EO14028: 4e(i)(C), 4e(i)(E), 4e(i)(F), 4e(ii), 4e(iii), 4e(v), 4e(vi), 4e(ix) IEC62443: SM-7 NISTCSF: PR.AC-4, PR.AC-7, PR.IP-1, PR.IP-3, PR.IP-12, PR.PT-1, PR.PT-3, DE.CM SCAGILE: Tasks Requiring the Help of Security Experts 11 SCSIC: Vendor Software Delivery Integrity Controls SP80053: SA-15 SP800161: SA-15 SP800181: OM-ADM-001, SP-SYS-001; T0484, T0485, T0489, T0553; K0005, K0007, K0077, K0088, K0130, K0167, K0205, K0275; S0076, S0097, S0121, S0158; A0155
Protect All Forms of Code from Unauthorized Access and Tampering (PS.1): Help prevent unauthorized changes to code, both inadvertent and intentional, which could circumvent or negate the intended security characteristics of the software. For code that is not intended to be publicly accessible, this helps prevent theft of the software and may make it more difficult or time-consuming for attackers to find vulnerabilities in the software.	PS.1.1: Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access.	Example 1: Store all source code and configuration-as-code in a code repository, and restrict access to it based on the nature of the code. For example, open-source code intended for public access may need its integrity and availability protected; other code may also need its confidentiality protected. Example 2: Use version control features of the repository to track all changes made to the code with accountability to the individual account. Example 3: Use commit signing for code repositories. Example 4: Have the code owner review and approve all changes made to the code by others. Example 5: Use code signing to help protect the integrity of executables. Example 6: Use cryptography (e.g., cryptographic hashes) to help protect file integrity.	BSAFSS: IA.1, IA.2, SM.4-1, DE.1-2 BSIMM: SE2.4 CNCFSSCP: Securing the Source Code—Verification, Automation, Controlled Environments, Secure Authentication; Securing Materials—Automation EO14028: 4e(iii), 4e(iv), 4e(ix) IDASOAR: Fact Sheet 25 IEC62443: SM-6, SM-7, SM-8 NISTCSF: PR.AC-4, PR.DS-6, PR.IP-3 OWASPASVS: 1.10, 10.3.2 OWASPMASVS: 7.1 OWASPSAMM: OE3-B PCISSLC: 5.1, 6.1 SCSIC: Vendor Software Delivery Integrity Controls, Vendor Software Development Integrity Controls SP80053: SA-10 SP800161: SA-8, SA-10
Provide a Mechanism for Verifying Software Release Integrity (PS.2): Help software acquirers ensure that the software they acquire is legitimate and has not been tampered with.	PS.2.1: Make software integrity verification information available to software acquirers.	Example 1: Post cryptographic hashes for release files on a well-secured website. Example 2: Use an established certificate authority for code signing so that consumers’ operating systems or other tools and services can confirm the validity of signatures before use. Example 3: Periodically review the code signing processes, including certificate renewal, rotation, revocation, and protection.	BSAFSS: SM.4, SM.5, SM.6 BSIMM: SE2.4 CNCFSSCP: Securing Deployments—Verification EO14028: 4e(iii), 4e(ix), 4e(x) IEC62443: SM-6, SM-8, SUM-4 NISTCSF: PR.DS-6 NISTLABEL: 2.2.2.4 OWASPSAMM: OE3-B OWASPSCVS: 4 PCISSLC: 6.1, 6.2 SCSIC: Vendor Software Delivery Integrity Controls SP80053: SA-8 SP800161: SA-8 SP800181: K0178
Archive and Protect Each Software Release (PS.3): Preserve software releases in order to help identify, analyze, and eliminate vulnerabilities discovered in the software after release.	PS.3.1: Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software release.	Example 1: Store the release files, associated images, etc. in repositories following the organization’s established policy. Allow read-only access to them by necessary personnel and no access by anyone else. Example 2: Store and protect release integrity verification information and provenance data, such as by keeping it in a separate location from the release files or by signing the data.	BSAFSS: PD.1-5, DE.1-2, IA.2 CNCFSSCP: Securing Artefacts—Automation, Controlled Environments, Encryption; Securing Deployments—Verification EO14028: 4e(iii), 4e(vi), 4e(ix), 4e(x) IDASOAR: 25 IEC62443: SM-6, SM-7 NISTCSF: PR.IP-4 OWASPSCVS: 1, 3.18, 3.19, 6.3 PCISSLC: 5.2, 6.1, 6.2 SCSIC: Vendor Software Delivery Integrity Controls SP80053: SA-10, SA-15, SA-15(11), SR-4 SP800161: SA-8, SA-10, SA-15(11), SR-4
	PS.3.2: Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials [SBOM]).	Example 1: Make the provenance data available to software acquirers in accordance with the organization’s policies, preferably using standards-based formats. Example 2: Make the provenance data available to the organization’s operations and response teams to aid them in mitigating software vulnerabilities. Example 3: Protect the integrity of provenance data, and provide a way for recipients to verify provenance data integrity. Example 4: Update the provenance data every time any of the software’s components are updated.	BSAFSS: SM.2 BSIMM: SE3.6 CNCFSSCP: Securing Materials—Verification, Automation EO14028: 4e(vi), 4e(vii), 4e(ix), 4e(x) NTIASBOM: All OWASPSCVS: 1.4, 2 SCSIC: Vendor Software Delivery Integrity Controls SCTPC: MAINTAIN3 SP80053: SA-8, SR-3, SR-4 SP800161: SA-8, SR-3, SR-4
Design Software to Meet Security Requirements and Mitigate Security Risks (PW.1): Identify and evaluate the security requirements for the software; determine what security risks the software is likely to face during operation and how the software’s design and architecture should mitigate those risks; and justify any cases where risk-based analysis indicates that security requirements should be relaxed or waived. Addressing security requirements and risks during software design (secure by design) is key for improving software security and also helps improve development efficiency.	PW.1.1: Use forms of risk modeling – such as threat modeling, attack modeling, or attack surface mapping – to help assess the security risk for the software.	Example 1: Train the development team (security champions, in particular) or collaborate with a risk modeling expert to create models and analyze how to use a risk-based approach to communicate the risks and determine how to address them, including implementing mitigations. Example 2: Perform more rigorous assessments for high-risk areas, such as protecting sensitive data and safeguarding identification, authentication, and access control, including credential management. Example 3: Review vulnerability reports and statistics for previous software to inform the security risk assessment. Example 4: Use data classification methods to identify and characterize each type of data that the software will interact with.	BSAFSS: SC.1 BSIMM: AM1.2, AM1.3, AM1.5, AM2.1, AM2.2, AM2.5, AM2.6, AM2.7, SFD2.2, AA1.1, AA1.2, AA1.3, AA2.1 EO14028: 4e(ix) IDASOAR: 1 IEC62443: SM-4, SR-1, SR-2, SD-1 IR8397: 2.1 ISO27034: 7.3.3 MSSDL: 4 NISTCSF: ID.RA OWASPASVS: 1.1.2, 1.2, 1.4, 1.6, 1.8, 1.9, 1.11, 2, 3, 4, 6, 8, 9, 11, 12, 13 OWASPMASVS: 1.6, 1.8, 2, 3, 4, 5, 6 OWASPSAMM: TA1-A, TA1-B, TA3-B, DR1-A PCISSLC: 3.2, 3.3 SCAGILE: Tasks Requiring the Help of Security Experts 3 SCFPSSD: Threat Modeling SCTTM: Entire guide SP80053: SA-8, SA-11(2), SA-11(6), SA-15(5) SP800160: 3.3.4, 3.4.5 SP800161: SA-8, SA-11(2), SA-11(6), SA-15(5) SP800181: T0038, T0062; K0005, K0009, K0038, K0039, K0070, K0080, K0119, K0147, K0149, K0151, K0152, K0160, K0161, K0162, K0165, K0297, K0310, K0344, K0362, K0487, K0624; S0006, S0009, S0022, S0078, S0171, S0229, S0248; A0092, A0093, A0107
	PW.1.2: Track and maintain the software’s security requirements, risks, and design decisions.	Example 1: Record the response to each risk, including how mitigations are to be achieved and what the rationales are for any approved exceptions to the security requirements. Add any mitigations to the software’s security requirements. Example 2: Maintain records of design decisions, risk responses, and approved exceptions that can be used for auditing and maintenance purposes throughout the rest of the software life cycle. Example 3: Periodically re-evaluate all approved exceptions to the security requirements, and implement changes as needed.	BSAFSS: SC.1-1, PD.1-1 BSIMM: SFD3.1, SFD3.3, AA2.2, AA3.2 EO14028: 4e(v), 4e(ix) IEC62443: SD-1 ISO27034: 7.3.3 MSSDL: 4 NISTLABEL: 2.2.2.2 OWASPASVS: 1.1.3, 1.1.4 OWASPMASVS: 1.3, 1.6 OWASPSAMM: DR1-B PCISSLC: 3.2, 3.3 SP80053: SA-8, SA-10, SA-17 SP800161: SA-8, SA-17 SP800181: T0256; K0005, K0038, K0039, K0147, K0149, K0160, K0161, K0162, K0165, K0344, K0362, K0487; S0006, S0009, S0078, S0171, S0229, S0248; A0092, A0107
	PW.1.3: Where appropriate, build in support for using standardized security features and services (e.g., enabling software to integrate with existing log management, identity management, access control, and vulnerability management systems) instead of creating proprietary implementations of security features and services. [Formerly PW.4.3]	Example 1: Maintain one or more software repositories of modules for supporting standardized security features and services. Example 2: Determine secure configurations for modules for supporting standardized security features and services, and make these configurations available (e.g., as configuration-as-code) so developers can readily use them. Example 3: Define criteria for which security features and services must be supported by software to be developed.	BSAFSS: SI.2-1, SI.2-2, LO.1 BSIMM: SFD1.1, SFD2.1, SFD3.2, SR1.1, SR3.4 EO14028: 4e(ix) IEC62443: SD-1, SD-4 MSSDL: 5 OWASPASVS: 1.1.6 OWASPSAMM: SA2-A SCFPSSD: Standardize Identity and Access Management; Establish Log Requirements and Audit Practices
Review the Software Design to Verify Compliance with Security Requirements and Risk Information (PW.2): Help ensure that the software will meet the security requirements and satisfactorily address the identified risk information.	PW.2.1: Have 1) a qualified person (or people) who were not involved with the design and/or 2) automated processes instantiated in the toolchain review the software design to confirm and enforce that it meets all of the security requirements and satisfactorily addresses the identified risk information.	Example 1: Review the software design to confirm that it addresses applicable security requirements. Example 2: Review the risk models created during software design to determine if they appear to adequately identify the risks. Example 3: Review the software design to confirm that it satisfactorily addresses the risks identified by the risk models. Example 4: Have the software’s designer correct failures to meet the requirements. Example 5: Change the design and/or the risk response strategy if the security requirements cannot be met. Example 6: Record the findings of design reviews to serve as artifacts (e.g., in the software specification, in the issue tracking system, in the threat model).	BSAFSS: TV.3 BSIMM: AA1.1, AA1.2, AA1.3, AA2.1, AA3.1 EO14028: 4e(iv), 4e(v), 4e(ix) IEC62443: SM-2, SR-2, SR-5, SD-3, SD-4, SI-2 ISO27034: 7.3.3 OWASPASVS: 1.1.5 OWASPSAMM: DR1-A, DR1-B PCISSLC: 3.2 SP800181: T0328; K0038, K0039, K0070, K0080, K0119, K0152, K0153, K0161, K0165, K0172, K0297; S0006, S0009, S0022, S0036, S0141, S0171
Reuse Existing, Well-Secured Software When Feasible Instead of Duplicating Functionality (PW.4): Lower the costs of software development, expedite software development, and decrease the likelihood of introducing additional security vulnerabilities into the software by reusing software modules and services that have already had their security posture checked. This is particularly important for software that implements security functionality, such as cryptographic modules and protocols.	PW.4.1: Acquire and maintain well-secured software components (e.g., software libraries, modules, middleware, frameworks) from commercial, open-source, and other third-party developers for use by the organization’s software.	Example 1: Review and evaluate third-party software components in the context of their expected use. If a component is to be used in a substantially different way in the future, perform the review and evaluation again with that new context in mind. Example 2: Determine secure configurations for software components, and make these available (e.g., as configuration-as-code) so developers can readily use the configurations. Example 3: Obtain provenance information (e.g., SBOM, source composition analysis, binary software composition analysis) for each software component, and analyze that information to better assess the risk that the component may introduce. Example 4: Establish one or more software repositories to host sanctioned and vetted open-source components. Example 5: Maintain a list of organization-approved commercial software components and component versions along with their provenance data. Example 6: Designate which components must be included in software to be developed. Example 7: Implement processes to update deployed software components to newer versions, and retain older versions of software components until all transitions from those versions have been completed successfully. Example 8: If the integrity or provenance of acquired binaries cannot be confirmed, build binaries from source code after verifying the source code’s integrity and provenance.	BSAFSS: SM.2 BSIMM: SFD2.1, SFD3.2, SR2.4, SR3.1, SE3.6 CNCFSSCP: Securing Materials—Verification EO14028: 4e(iii), 4e(vi), 4e(ix), 4e(x) IDASOAR: 19 IEC62443: SM-9, SM-10 MSSDL: 6 NISTCSF: ID.SC-2 OWASPASVS: 1.1.6 OWASPSAMM: SA1-A OWASPSCVS: 4 SCSIC: Vendor Sourcing Integrity Controls SCTPC: MAINTAIN SP80053: SA-4, SA-5, SA-8(3), SA-10(6), SR-3, SR-4 SP800161: SA-4, SA-5, SA-8(3), SA-10(6), SR-3, SR-4 SP800181: K0039
	PW.4.2: Create and maintain well-secured software components in-house following SDLC processes to meet common internal software development needs that cannot be better met by third-party software components.	Example 1: Follow organization-established security practices for secure software development when creating and maintaining the components. Example 2: Determine secure configurations for software components, and make these available (e.g., as configuration-as-code) so developers can readily use the configurations. Example 3: Maintain one or more software repositories for these components. Example 4: Designate which components must be included in software to be developed. Example 5: Implement processes to update deployed software components to newer versions, and maintain older versions of software components until all transitions from those versions have been completed successfully.	BSIMM: SFD1.1, SFD2.1, SFD3.2, SR1.1 EO14028: 4e(ix) IDASOAR: 19 OWASPASVS: 1.1.6 SCTPC: MAINTAIN SP80053: SA-8(3) SP800161: SA-8(3) SP800181: SP-DEV-001
	PW.4.4: Verify that acquired commercial, open-source, and all other third-party software components comply with the requirements, as defined by the organization, throughout their life cycles.	Example 1: Regularly check whether there are publicly known vulnerabilities in the software modules and services that vendors have not yet fixed. Example 2: Build into the toolchain automatic detection of known vulnerabilities in software components. Example 3: Use existing results from commercial services for vetting the software modules and services. Example 4: Ensure that each software component is still actively maintained and has not reached end of life; this should include new vulnerabilities found in the software being remediated. Example 5: Determine a plan of action for each software component that is no longer being maintained or will not be available in the near future. Example 6: Confirm the integrity of software components through digital signatures or other mechanisms. Example 7: Review, analyze, and/or test code. See PW.7 and PW.8.	BSAFSS: SC.3-1, SM.2-1, SM.2-2, SM.2-3, TV.2, TV.3 BSIMM: CP3.2, SR2.4, SR3.1, SR3.2, SE2.4, SE3.6 CNCFSSCP: Securing Materials—Verification, Automation EO14028: 4e(iii), 4e(iv), 4e(vi), 4e(ix), 4e(x) IDASOAR: 21 IEC62443: SI-1, SM-9, SM-10, DM-1 IR8397: 2.11 MSSDL: 7 NISTCSF: ID.SC-4, PR.DS-6 NISTLABEL: 2.2.2.2 OWASPASVS: 10, 14.2 OWASPMASVS: 7.5 OWASPSAMM: TA3-A, SR3-B OWASPSCVS: 4, 5, 6 PCISSLC: 3.2, 3.4, 4.1 SCAGILE: Tasks Requiring the Help of Security Experts 8 SCFPSSD: Manage Security Risk Inherent in the Use of Third-Party Components SCSIC: Vendor Sourcing Integrity Controls, Peer Reviews and Security Testing SCTPC: MAINTAIN, ASSESS SP80053: SA-9, SR-3, SR-4, SR-4(3), SR-4(4) SP800160: 3.1.2, 3.3.8 SP800161: SA-4, SA-8, SA-9, SA-9(3), SR-3, SR-4, SR-4(3), SR-4(4) SP800181: SP-DEV-002; K0153, K0266; S0298
Create Source Code by Adhering to Secure Coding Practices (PW.5): Decrease the number of security vulnerabilities in the software, and reduce costs by minimizing vulnerabilities introduced during source code creation that meet or exceed organization-defined vulnerability severity criteria.	PW.5.1: Follow all secure coding practices that are appropriate to the development languages and environment to meet the organization’s requirements.	Example 1: Validate all inputs, and validate and properly encode all outputs. Example 2: Avoid using unsafe functions and calls. Example 3: Detect errors, and handle them gracefully. Example 4: Provide logging and tracing capabilities. Example 5: Use development environments with automated features that encourage or require the use of secure coding practices with just-in-time training-in-place. Example 6: Follow procedures for manually ensuring compliance with secure coding practices when automated methods are insufficient or unavailable. Example 7: Use tools (e.g., linters, formatters) to standardize the style and formatting of the source code. Example 8: Check for other vulnerabilities that are common to the development languages and environment. Example 9: Have the developer review their own human-readable code to complement (not replace) code review performed by other people or tools. See PW.7.	BSAFSS: SC.2, SC.3, LO.1, EE.1 BSIMM: SR3.3, CR1.4, CR3.5 EO14028: 4e(iv), 4e(ix) IDASOAR: 2 IEC62443: SI-1, SI-2 ISO27034: 7.3.5 MSSDL: 9 OWASPASVS: 1.1.7, 1.5, 1.7, 5, 7 OWASPMASVS: 7.6 SCFPSSD: Establish Log Requirements and Audit Practices, Use Code Analysis Tools to Find Security Issues Early, Handle Data Safely, Handle Errors, Use Safe Functions Only SP800181: SP-DEV-001; T0013, T0077, T0176; K0009, K0016, K0039, K0070, K0140, K0624; S0019, S0060, S0149, S0172, S0266; A0036, A0047
Configure the Compilation, Interpreter, and Build Processes to Improve Executable Security (PW.6): Decrease the number of security vulnerabilities in the software and reduce costs by eliminating vulnerabilities before testing occurs.	PW.6.1: Use compiler, interpreter, and build tools that offer features to improve executable security.	Example 1: Use up-to-date versions of compiler, interpreter, and build tools. Example 2: Follow change management processes when deploying or updating compiler, interpreter, and build tools, and audit all unexpected changes to tools. Example 3: Regularly validate the authenticity and integrity of compiler, interpreter, and build tools. See PO.3.	BSAFSS: DE.2-1 BSIMM: SE2.4 CNCFSSCP: Securing Build Pipelines—Verification, Automation EO14028: 4e(iv), 4e(ix) IEC62443: SI-2 MSSDL: 8 SCAGILE: Operational Security Task 3 SCFPSSD: Use Current Compiler and Toolchain Versions and Secure Compiler Options SCSIC: Vendor Software Development Integrity Controls SP80053: SA-15 SP800161: SA-15
	PW.6.2: Determine which compiler, interpreter, and build tool features should be used and how each should be configured, then implement and use the approved configurations.	Example 1: Enable compiler features that produce warnings for poorly secured code during the compilation process. Example 2: Implement the “clean build” concept, where all compiler warnings are treated as errors and eliminated except those determined to be false positives or irrelevant. Example 3: Perform all builds in a dedicated, highly controlled build environment. Example 4: Enable compiler features that randomize or obfuscate execution characteristics, such as memory location usage, that would otherwise be predictable and thus potentially exploitable. Example 5: Test to ensure that the features are working as expected and are not inadvertently causing any operational issues or other problems. Example 6: Continuously verify that the approved configurations are being used. Example 7: Make the approved tool configurations available as configuration-as-code so developers can readily use them.	BSAFSS: DE.2-3, DE.2-4, DE.2-5 BSIMM: SE2.4, SE3.2 CNCFSSCP: Securing Build Pipelines—Verification, Automation EO14028: 4e(iv), 4e(ix) IEC62443: SI-2 IR8397: 2.5 MSSDL: 8 OWASPASVS: 14.1, 14.2.1 OWASPMASVS: 7.2 PCISSLC: 3.2 SCAGILE: Operational Security Task 8 SCFPSSD: Use Current Compiler and Toolchain Versions and Secure Compiler Options SCSIC: Vendor Software Development Integrity Controls SP80053: SA-15, SR-9 SP800161: SA-15, SR-9 SP800181: K0039, K0070
Review and/or Analyze Human-Readable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements (PW.7): Help identify vulnerabilities so that they can be corrected before the software is released to prevent exploitation. Using automated methods lowers the effort and resources needed to detect vulnerabilities. Human-readable code includes source code, scripts, and any other form of code that an organization deems human-readable.	PW.7.1: Determine whether code review (a person looks directly at the code to find issues) and/or code analysis (tools are used to find issues in code, either in a fully automated way or in conjunction with a person) should be used, as defined by the organization.	Example 1: Follow the organization’s policies or guidelines for when code review should be performed and how it should be conducted. This may include third-party code and reusable code modules written in-house. Example 2: Follow the organization’s policies or guidelines for when code analysis should be performed and how it should be conducted. Example 3: Choose code review and/or analysis methods based on the stage of the software.	BSIMM: CR1.5 EO14028: 4e(iv), 4e(ix) IEC62443: SM-5, SI-1, SVV-1 NISTLABEL: 2.2.2.2 SCSIC: Peer Reviews and Security Testing SP80053: SA-11 SP800161: SA-11 SP800181: SP-DEV-002; K0013, K0039, K0070, K0153, K0165; S0174
	PW.7.2: Perform the code review and/or code analysis based on the organization’s secure coding standards, and record and triage all discovered issues and recommended remediations in the development team’s workflow or issue tracking system.	Example 1: Perform peer review of code, and review any existing code review, analysis, or testing results as part of the peer review. Example 2: Use expert reviewers to check code for backdoors and other malicious content. Example 3: Use peer reviewing tools that facilitate the peer review process, and document all discussions and other feedback. Example 4: Use a static analysis tool to automatically check code for vulnerabilities and compliance with the organization’s secure coding standards with a human reviewing the issues reported by the tool and remediating them as necessary. Example 5: Use review checklists to verify that the code complies with the requirements. Example 6: Use automated tools to identify and remediate documented and verified unsafe software practices on a continuous basis as human-readable code is checked into the code repository. Example 7: Identify and document the root causes of discovered issues. Example 8: Document lessons learned from code review and analysis in a wiki that developers can access and search.	BSAFSS: TV.2, PD.1-4 BSIMM: CR1.2, CR1.4, CR1.6, CR2.6, CR2.7, CR3.4, CR3.5 EO14028: 4e(iv), 4e(v), 4e(ix) IDASOAR: 3, 4, 5, 14, 15, 48 IEC62443: SI-1, SVV-1, SVV-2 IR8397: 2.3, 2.4 ISO27034: 7.3.6 MSSDL: 9, 10 NISTLABEL: 2.2.2.2 OWASPASVS: 1.1.7, 10 OWASPMASVS: 7.5 OWASPSAMM: IR1-B, IR2-A, IR2-B, IR3-A PCISSLC: 3.2, 4.1 SCAGILE: Operational Security Tasks 4, 7; Tasks Requiring the Help of Security Experts 10 SCFPSSD: Use Code Analysis Tools to Find Security Issues Early, Use Static Analysis Security Testing Tools, Perform Manual Verification of Security Features/Mitigations SCSIC: Peer Reviews and Security Testing SP80053: SA-11, SA-11(1), SA-11(4), SA-15(7) SP800161: SA-11, SA-11(1), SA-11(4), SA-15(7) SP800181: SP-DEV-001, SP-DEV-002; T0013, T0111, T0176, T0267, T0516; K0009, K0039, K0070, K0140, K0624; S0019, S0060, S0078, S0137, S0149, S0167, S0174, S0242, S0266; A0007, A0015, A0036, A0044, A0047
Test Executable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements (PW.8): Help identify vulnerabilities so that they can be corrected before the software is released in order to prevent exploitation. Using automated methods lowers the effort and resources needed to detect vulnerabilities and improves traceability and repeatability. Executable code includes binaries, directly executed bytecode and source code, and any other form of code that an organization deems executable.	PW.8.1: Determine whether executable code testing should be performed to find vulnerabilities not identified by previous reviews, analysis, or testing and, if so, which types of testing should be used.	Example 1: Follow the organization’s policies or guidelines for when code testing should be performed and how it should be conducted (e.g., within a sandboxed environment). This may include third-party executable code and reusable executable code modules written in-house. Example 2: Choose testing methods based on the stage of the software.	BSAFSS: TV.3 BSIMM: PT2.3 EO14028: 4e(ix) IEC62443: SVV-1, SVV-2, SVV-3, SVV-4, SVV-5 NISTLABEL: 2.2.2.2 SCSIC: Peer Reviews and Security Testing SP80053: SA-11 SP800161: SA-11 SP800181: SP-DEV-001, SP-DEV-002; T0456; K0013, K0039, K0070, K0153, K0165, K0342, K0367, K0536, K0624; S0001, S0015, S0026, S0061, S0083, S0112, S0135
	PW.8.2: Scope the testing, design the tests, perform the testing, and document the results, including recording and triaging all discovered issues and recommended remediations in the development team’s workflow or issue tracking system.	Example 1: Perform robust functional testing of security features. Example 2: Integrate dynamic vulnerability testing into the project’s automated test suite. Example 3: Incorporate tests for previously reported vulnerabilities into the project’s test suite to ensure that errors are not reintroduced. Example 4: Take into consideration the infrastructures and technology stacks that the software will be used with in production when developing test plans. Example 5: Use fuzz testing tools to find issues with input handling. Example 6: If resources are available, use penetration testing to simulate how an attacker might attempt to compromise the software in high-risk scenarios. Example 7: Identify and record the root causes of discovered issues. Example 8: Document lessons learned from code testing in a wiki that developers can access and search. Example 9: Use source code, design records, and other resources when developing test plans.	BSAFSS: TV.3, TV.5, PD.1-4 BSIMM: ST1.1, ST1.3, ST1.4, ST2.4, ST2.5, ST2.6, ST3.3, ST3.4, ST3.5, ST3.6, PT1.1, PT1.2, PT1.3, PT3.1 EO14028: 4e(iv), 4e(v), 4e(ix) IDASOAR: 7, 8, 10, 11, 38, 39, 43, 44, 48, 55, 56, 57 IEC62443: SM-5, SM-13, SI-1, SVV-1, SVV-2, SVV-3, SVV-4, SVV-5 IR8397: 2.6, 2.7, 2.8, 2.9, 2.10, 2.11 ISO27034: 7.3.6 MSSDL: 10, 11 NISTLABEL: 2.2.2.2 OWASPMASVS: 7.5 OWASPSAMM: ST1-A, ST1-B, ST2-A, ST2-B, ST3-A PCISSLC: 4.1 SCAGILE: Operational Security Tasks 10, 11; Tasks Requiring the Help of Security Experts 4, 5, 6, 7 SCFPSSD: Perform Dynamic Analysis Security Testing, Fuzz Parsers, Network Vulnerability Scanning, Perform Automated Functional Testing of Security Features/Mitigations, Perform Penetration Testing SCSIC: Peer Reviews and Security Testing SP80053: SA-11, SA-11(5), SA-11(8), SA-15(7) SP800161: SA-11, SA-11(5), SA-11(8), SA-15(7) SP800181: SP-DEV-001, SP-DEV-002; T0013, T0028, T0169, T0176, T0253, T0266, T0456, T0516; K0009, K0039, K0070, K0272, K0339, K0342, K0362, K0536, K0624; S0001, S0015, S0046, S0051, S0078, S0081, S0083, S0135, S0137, S0167, S0242; A0015
Configure Software to Have Secure Settings by Default (PW.9): Help improve the security of the software at the time of installation to reduce the likelihood of the software being deployed with weak security settings, putting it at greater risk of compromise.	PW.9.1: Define a secure baseline by determining how to configure each setting that has an effect on security or a security-related setting so that the default settings are secure and do not weaken the security functions provided by the platform, network infrastructure, or services.	Example 1: Conduct testing to ensure that the settings, including the default settings, are working as expected and are not inadvertently causing any security weaknesses, operational issues, or other problems.	BSAFSS: CF.1 BSIMM: SE2.2 EO14028: 4e(iv), 4e(ix) IDASOAR: 23 IEC62443: SD-4, SVV-1, SG-1 ISO27034: 7.3.5 SCAGILE: Tasks Requiring the Help of Security Experts 12 SCSIC: Vendor Software Delivery Integrity Controls, Vendor Software Development Integrity Controls SP800181: SP-DEV-002; K0009, K0039, K0073, K0153, K0165, K0275, K0531; S0167
	PW.9.2: Implement the default settings (or groups of default settings, if applicable), and document each setting for software administrators.	Example 1: Verify that the approved configuration is in place for the software. Example 2: Document each setting’s purpose, options, default value, security relevance, potential operational impact, and relationships with other settings. Example 3: Use authoritative programmatic technical mechanisms to record how each setting can be implemented and assessed by software administrators. Example 4: Store the default configuration in a usable format and follow change control practices for modifying it (e.g., configuration-as-code).	BSAFSS: CF.1 BSIMM: SE2.2 EO14028: 4e(iv), 4e(ix) IDASOAR: 23 IEC62443: SG-3 OWASPSAMM: OE1-A PCISSLC: 8.1, 8.2 SCAGILE: Tasks Requiring the Help of Security Experts 12 SCFPSSD: Verify Secure Configurations and Use of Platform Mitigation SCSIC: Vendor Software Delivery Integrity Controls, Vendor Software Development Integrity Controls SP80053: SA-5, SA-8(23) SP800161: SA-5, SA-8(23) SP800181: SP-DEV-001; K0009, K0039, K0073, K0153, K0165, K0275, K0531
Identify and Confirm Vulnerabilities on an Ongoing Basis (RV.1): Help ensure that vulnerabilities are identified more quickly so that they can be remediated more quickly in accordance with risk, reducing the window of opportunity for attackers.	RV.1.1: Gather information from software acquirers, users, and public sources on potential vulnerabilities in the software and third-party components that the software uses, and investigate all credible reports.	Example 1: Monitor vulnerability databases , security mailing lists, and other sources of vulnerability reports through manual or automated means. Example 2: Use threat intelligence sources to better understand how vulnerabilities in general are being exploited. Example 3: Automatically review provenance and software composition data for all software components to identify any new vulnerabilities they have.	BSAFSS: VM.1-3, VM.3 BSIMM: AM1.5, CMVM1.2, CMVM2.1, CMVM3.4, CMVM3.7 CNCFSSCP: Securing Materials—Verification EO14028: 4e(iv), 4e(vi), 4e(viii), 4e(ix) IEC62443: DM-1, DM-2, DM-3 ISO29147: 6.2.1, 6.2.2, 6.2.4, 6.3, 6.5 ISO30111: 7.1.3 OWASPSAMM: IM1-A, IM2-B, EH1-B OWASPSCVS: 4 PCISSLC: 3.4, 4.1, 9.1 SCAGILE: Operational Security Task 5 SCFPSSD: Vulnerability Response and Disclosure SCTPC: MONITOR1 SP80053: SA-10, SR-3, SR-4 SP800161: SA-10, SR-3, SR-4 SP800181: K0009, K0038, K0040, K0070, K0161, K0362; S0078
	RV.1.2: Review, analyze, and/or test the software’s code to identify or confirm the presence of previously undetected vulnerabilities.	Example 1: Configure the toolchain to perform automated code analysis and testing on a regular or continuous basis for all supported releases. Example 2: See PW.7 and PW.8.	BSAFSS: VM.1-2, VM.2-1 BSIMM: CMVM3.1 EO14028: 4e(iv), 4e(vi), 4e(viii), 4e(ix) IEC62443: SI-1, SVV-2, SVV-3, SVV-4, DM-1, DM-2 ISO27034: 7.3.6 ISO29147: 6.4 ISO30111: 7.1.4 PCISSLC: 3.4, 4.1 SCAGILE: Operational Security Tasks 10, 11 SP80053: SA-11 SP800161: SA-11 SP800181: SP-DEV-002; K0009, K0039, K0153
	RV.1.3: Have a policy that addresses vulnerability disclosure and remediation, and implement the roles, responsibilities, and processes needed to support that policy.	Example 1: Establish a vulnerability disclosure program, and make it easy for security researchers to learn about your program and report possible vulnerabilities. Example 2: Have a Product Security Incident Response Team (PSIRT) and processes in place to handle the responses to vulnerability reports and incidents, including communications plans for all stakeholders. Example 3: Have a security response playbook to handle a generic reported vulnerability, a report of zero-days, a vulnerability being exploited in the wild, and a major ongoing incident involving multiple parties and open-source software components. Example 4: Periodically conduct exercises of the product security incident response processes.	BSAFSS: VM.1-1, VM.2 BSIMM: CMVM1.1, CMVM2.1, CMVM3.3, CMVM3.7 EO14028: 4e(viii), 4e(ix) IEC62443: DM-1, DM-2, DM-3, DM-4, DM-5 ISO29147: All ISO30111: All MSSDL: 12 NISTLABEL: 2.2.2.3 OWASPMASVS: 1.11 OWASPSAMM: IM1-A, IM1-B, IM2-A, IM2-B PCISSLC: 9.2, 9.3 SCFPSSD: Vulnerability Response and Disclosure SP80053: SA-15(10) SP800160: 3.3.8 SP800161: SA-15(10) SP800181: K0041, K0042, K0151, K0292, K0317; S0054; A0025 SP800216: All
Assess, Prioritize, and Remediate Vulnerabilities (RV.2): Help ensure that vulnerabilities are remediated in accordance with risk to reduce the window of opportunity for attackers.	RV.2.1: Analyze each vulnerability to gather sufficient information about risk to plan its remediation or other risk response.	Example 1: Use existing issue tracking software to record each vulnerability. Example 2: Perform risk calculations for each vulnerability based on estimates of its exploitability, the potential impact if exploited, and any other relevant characteristics.	BSAFSS: VM.2 BSIMM: CMVM1.2, CMVM2.2 EO14028: 4e(iv), 4e(viii), 4e(ix) IEC62443: DM-2, DM-3 ISO30111: 7.1.4 NISTLABEL: 2.2.2.2 PCISSLC: 3.4, 4.2 SCAGILE: Operational Security Task 1, Tasks Requiring the Help of Security Experts 10 SP80053: SA-10, SA-15(7) SP800160: 3.3.8 SP800161: SA-15(7) SP800181: K0009, K0039, K0070, K0161, K0165; S0078
	RV.2.2: Plan and implement risk responses for vulnerabilities.	Example 1: Make a risk-based decision as to whether each vulnerability will be remediated or if the risk will be addressed through other means (e.g., risk acceptance, risk transference), and prioritize any actions to be taken. Example 2: If a permanent mitigation for a vulnerability is not yet available, determine how the vulnerability can be temporarily mitigated until the permanent solution is available, and add that temporary remediation to the plan. Example 3: Develop and release security advisories that provide the necessary information to software acquirers, including descriptions of what the vulnerabilities are, how to find instances of the vulnerable software, and how to address them (e.g., where to get patches and what the patches change in the software; what configuration settings may need to be changed; how temporary workarounds could be implemented). Example 4: Deliver remediations to acquirers via an automated and trusted delivery mechanism. A single remediation could address multiple vulnerabilities. Example 5: Update records of design decisions, risk responses, and approved exceptions as needed. See PW.1.2.	BSAFSS: VM.1-1, VM-2 BSIMM: CMVM2.1 EO14028: 4e(iv), 4e(vi), 4e(viii), 4e(ix) IEC62443: DM-4 ISO30111: 7.1.4, 7.1.5 NISTLABEL: 2.2.2.2 PCISSLC: 4.1, 4.2, 10.1 SCAGILE: Operational Security Task 2 SCFPSSD: Fix the Vulnerability, Identify Mitigating Factors or Workarounds SCTPC: MITIGATE SP80053: SA-5, SA-10, SA-11, SA-15(7) SP800160: 3.3.8 SP800161: SA-5, SA-8, SA-10, SA-11, SA-15(7) SP800181: T0163, T0229, T0264; K0009, K0070
Analyze Vulnerabilities to Identify Their Root Causes (RV.3): Help reduce the frequency of vulnerabilities in the future.	RV.3.1: Analyze identified vulnerabilities to determine their root causes.	Example 1: Record the root cause of discovered issues. Example 2: Record lessons learned through root cause analysis in a wiki that developers can access and search.	BSAFSS: VM.2-1 BSIMM: CMVM3.1, CMVM3.2 EO14028: 4e(ix) IEC62443: DM-3 ISO30111: 7.1.4 OWASPSAMM: IM3-A PCISSLC: 4.2 SCFPSSD: Secure Development Lifecycle Feedback SP800181: T0047, K0009, K0039, K0070, K0343
	RV.3.2: Analyze the root causes over time to identify patterns, such as a particular secure coding practice not being followed consistently.	Example 1: Record lessons learned through root cause analysis in a wiki that developers can access and search. Example 2: Add mechanisms to the toolchain to automatically detect future instances of the root cause. Example 3: Update manual processes to detect future instances of the root cause.	BSAFSS: VM.2-1, PD.1-3 BSIMM: CP3.3, CMVM3.2 EO14028: 4e(ix) IEC62443: DM-4 ISO30111: 7.1.7 OWASPSAMM: IM3-B PCISSLC: 2.6, 4.2 SCFPSSD: Secure Development Lifecycle Feedback SP800160: 3.3.8 SP800181: T0111, K0009, K0039, K0070, K0343
	RV.3.3: Review the software for similar vulnerabilities to eradicate a class of vulnerabilities, and proactively fix them rather than waiting for external reports.	Example 1: See PW.7 and PW.8.	BSAFSS: VM.2 BSIMM: CR3.3, CMVM3.1 EO14028: 4e(iv), 4e(viii), 4e(ix) IEC62443: SI-1, DM-3, DM-4 ISO30111: 7.1.4 PCISSLC: 4.2 SP80053: SA-11 SP800161: SA-11 SP800181: SP-DEV-001, SP-DEV-002; K0009, K0039, K0070
	RV.3.4: Review the SDLC process, and update it if appropriate to prevent (or reduce the likelihood of) the root cause recurring in updates to the software or in new software that is created.	Example 1: Record lessons learned through root cause analysis in a wiki that developers can access and search. Example 2: Plan and implement changes to the appropriate SDLC practices.	BSAFSS: PD.1-3 BSIMM: CP3.3, CMVM3.2 EO14028: 4e(ix) IEC62443: DM-6 ISO30111: 7.1.7 MSSDL: 2 PCISSLC: 2.6, 4.2 SCFPSSD: Secure Development Lifecycle Feedback SP80053: SA-15 SP800161: SA-15 SP800181: K0009, K0039, K0070

References

The SSDF Table was originally published at NIST SP 800-218: Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities.

Red Hat UBI Compatibility

Fri, 23 Feb 2024 15:56:52 -0700

Chainguard Containers and Red Hat UBI base images have different binaries and scripts included in their respective busybox and coreutils packages. Note that Red Hat UBI images by default do not have a busybox package.

The following table lists common tools and their corresponding package(s) in both Wolfi and Red Hat distributions.

Minimum Attestation References

Wed, 10 May 2023 15:21:01 +0200

The minimum requirements within the Secure Software Attestation Form address requirements put forth in EO 14028 subsection (4)(e) and specific SSDF practices and tasks. For reference, please review the chart below.

Attestation Requirements	Related EO 14028 Subsection	Related SSDF Practices and Tasks
1) The software was developed and built in secure environments. Those environments were secured by the following actions, at a minimum:	4e(i)	[See rows below]
a) Separating and protecting each environment involved in developing and building software;	4e(i)(A)	PO.5.1
b) Regularly logging, monitoring, and auditing trust relationships used for authorization and access: i) to any software development and build environments; and ii) among components within each environment;	4e(i)(B)	PO.5.1
c) Enforcing multi-factor authentication and conditional access across the environments relevant to developing and building software in a manner that minimizes security risk;	4e(i)(C)	PO.5.1, PO.5.2
d) Taking consistent and reasonable steps to document, as well as minimize use or inclusion of software products that create undue risk, within the environments used to develop and build software;	4e(i)(D)	PO.5.1
e) Encrypting sensitive data, such as credentials, to the extent practicable and based on risk;	4e(i)(E)	PO.5.2
f) Implementing defensive cyber security practices, including continuous monitoring of operations and alerts and, as necessary, responding to suspected and confirmed cyber incidents;	4e(i)(F)	PO.3.2, PO.3.3, PO.5.1, PO.5.2
2) The software producer has made a good-faith effort to maintain trusted source code supply chains by:
a) Employing automated tools or comparable processes; and b) Establishing a process that includes reasonable steps to address the security of third-party components and manage related vulnerabilities;	4e(iii)	PO 1.1, PO.3.1, PO.3.2, PO.5.1, PO.5.2, PS.1.1, PS.2.1, PS.3.1, PW.4.1, PW.4.4, PW 7.1, PW 8.1, RV 1.1
3) The software producer maintains provenance data for internal and third-party code incorporated into the software;	4e(vi)	PO.1.3, PO.3.2, PO.5.1, PO.5.2, PS.3.1, PS.3.2, PW.4.1, PW.4.4, RV.1.1, RV.1.2
4) The software producer employed automated tools or comparable processes that check for security vulnerabilities. In addition: a) The software producer ensured these processes operate on an ongoing basis and, at a minimum, prior to product, version, or update releases and b) The software producer has a policy or process to address discovered security vulnerabilities prior to product release; and c) The software producer operates a vulnerability disclosure program and accepts, reviews, and addresses disclosed software vulnerabilities in a timely fashion.	4e(iv)	PO.4.1, PO.4.2, PS.1.1, PW.2.1, PW.4.4, PW.5.1, PW.6.1, PW.6.2, PW.7.1, PW.7.2, PW.8.2, PW.9.1, PW.9.2.

References

Table of the references comes from the top of the original RFC PDF.

Verify that Chainguard FIPS Containers are Configured to Use FIPS Modules

Sun, 23 Nov 2025 08:04:00 +0000

Chainguard offers hundreds of FIPS container image variants covering language runtimes (Go, Java, Python, Node.js, .NET, PHP, C/C++), databases, web servers, and Kubernetes components. These images use NIST-validated cryptographic modules including the OpenSSL FIPS provider, Bouncy Castle FIPS, and BoringCrypto. Refer to Chainguard’s FIPS Commitment for a full list of the modules used in Chainguard FIPS Images, as well as their respective CMVP certificates and SBOM indicators.

This guide outlines how to verify that Chainguard’s FIPS images are properly configured to use these FIPS modules.

chainctl Reference

Tue, 20 Sep 2022 08:49:15 +0000

The CLI tool chainctl helps you interact with the account model that Chainguard provides. The tool uses the familiar <context> <noun> <verb> style of CLI interactions. Below find the current reference for chainctl.

To install chainctl, follow our installation guide. Additionally, you may find these resources on working with chainctl to be of interest:

Example Policies

Fri, 15 Jul 2022 15:22:20 +0100

The Sigstore Policy Controller allows users to create their own security policies that they can be enforced on Kubernetes clusters. Here are a few example policies to help you get started.

You may also review the Sigstore Policy Controller documentation. In particular, we encourage you to review the Policy Controller documentation relating to the Admission of images to learn how to admit images through the cluster image policy.

Policy enforcing signed containers

apiVersion: policy.sigstore.dev/v1beta1
kind: ClusterImagePolicy
metadata:
name: signed-keyless
spec:
images:
# All images
- glob: "**"
authorities:
- keyless:
url: https://fulcio.sigstore.dev
ctlog:
url: https://rekor.sigstore.dev

Example using Chainguard Containers from Chainguard’s registry:

Vulnerability Comparison: bash

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: busybox

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: curl

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: deno

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: dex

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: dotnet-runtime

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: dotnet-sdk

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: etcd

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: git

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: go

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: gradle

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: haproxy

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: jenkins

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: kube-state-metrics

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: mariadb

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: maven

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: memcached

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: minio

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: minio-client

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: nats

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: nginx

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: node

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: opensearch

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: php

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: postgres

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: python

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: r-base

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: rabbitmq

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: redis

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: ruby

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: rust

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: telegraf

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: traefik

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: wait-for-it

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: wolfi-base

Tue, 01 Nov 2022 11:07:52 +0200

Vulnerability Comparison: zookeeper

Tue, 01 Nov 2022 11:07:52 +0200

Chainguard Trademark Use Policy

Fri, 06 Dec 2024 15:21:01 +0200

Chainguard has a Trademark Use Policy for Chainguard™ and Wolfi™. The Trademark Use Policy for Chainguard™ is in connection with its software tools and platforms for container image registry services and related educational services. The Trademark Use Policy for Wolfi™ is in connection with software tools and related community services. This policy helps ensure that Chainguard’s trademarks remain reliable indicators of the qualities that they are meant to preserve.

The Trademark Policy details:

chainctl

Fri, 12 Jun 2026 17:28:47 +0000

chainctl

Chainguard Control

chainctl actions

Fri, 12 Jun 2026 17:28:47 +0000

chainctl actions

Interact with the Chainguard Actions product.

chainctl actions catalog

Fri, 12 Jun 2026 17:28:47 +0000

chainctl actions catalog

Browse the public Chainguard Actions catalog.

chainctl actions catalog list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl actions catalog list

List Chainguard Actions in the public catalog.

chainctl actions discover

Fri, 12 Jun 2026 17:28:47 +0000

chainctl actions discover

Discover GitHub Actions dependencies used by your workflows.

chainctl actions entitlements

Fri, 12 Jun 2026 17:28:47 +0000

chainctl actions entitlements

Manage Actions product entitlements.

chainctl actions entitlements create

Fri, 12 Jun 2026 17:28:47 +0000

chainctl actions entitlements create

Enable the Actions product for an organization.

chainctl actions entitlements delete

Fri, 12 Jun 2026 17:28:47 +0000

chainctl actions entitlements delete

Disable the Actions product for an organization.

chainctl actions entitlements list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl actions entitlements list

List Actions product entitlements for an organization.

chainctl actions list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl actions list

List Chainguard Actions catalog entries for an organization.

chainctl agent

Fri, 12 Jun 2026 17:28:47 +0000

chainctl agent

Agent-powered commands.

chainctl agent accept-terms

Fri, 12 Jun 2026 17:28:47 +0000

chainctl agent accept-terms

Accept required legal terms.

chainctl auth

Fri, 12 Jun 2026 17:28:47 +0000

chainctl auth

Auth related commands for the Chainguard platform.

chainctl auth configure-docker

Fri, 12 Jun 2026 17:28:47 +0000

chainctl auth configure-docker

Configure a Docker credential helper

chainctl auth configure-npm

Fri, 12 Jun 2026 17:28:47 +0000

chainctl auth configure-npm

Configure npm credentials for Chainguard Libraries for JavaScript

chainctl auth delete-account

Fri, 12 Jun 2026 17:28:47 +0000

chainctl auth delete-account

Permanently delete your user account.

chainctl auth login

Fri, 12 Jun 2026 17:28:47 +0000

chainctl auth logout

Fri, 12 Jun 2026 17:28:47 +0000

chainctl auth logout

Logout from the Chainguard platform.

chainctl auth pull-token

Fri, 12 Jun 2026 17:28:47 +0000

chainctl auth pull-token

Create a pull token.

chainctl auth pull-token create

Fri, 12 Jun 2026 17:28:47 +0000

chainctl auth pull-token create

Create a pull token.

chainctl auth pull-token list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl auth pull-token list

List all pull-tokens

chainctl auth status

Fri, 12 Jun 2026 17:28:47 +0000

chainctl auth status

Inspect the local Chainguard Token.

chainctl auth token

Fri, 12 Jun 2026 17:28:47 +0000

chainctl auth token

Print the local Chainguard Token.

chainctl auth token capabilities

Fri, 12 Jun 2026 17:28:47 +0000

chainctl auth token capabilities

Print the capabilities of the local Chainguard Token.

chainctl config

Fri, 12 Jun 2026 17:28:47 +0000

chainctl config

Local config file commands for chainctl.

chainctl config edit

Fri, 12 Jun 2026 17:28:47 +0000

chainctl config edit

Edit the current chainctl config file.

chainctl config reset

Fri, 12 Jun 2026 17:28:47 +0000

chainctl config reset

Remove local chainctl config files and restore defaults.

chainctl config save

Fri, 12 Jun 2026 17:28:47 +0000

chainctl config save

Save the current chainctl config to a config file.

chainctl config set

Fri, 12 Jun 2026 17:28:47 +0000

chainctl config set

Set an individual configuration value property.

chainctl config unset

Fri, 12 Jun 2026 17:28:47 +0000

chainctl config unset

Unset a configuration property and return it to default.

chainctl config validate

Fri, 12 Jun 2026 17:28:47 +0000

chainctl config validate

Run diagnostics on local config.

chainctl config view

Fri, 12 Jun 2026 17:28:47 +0000

chainctl config view

View the current chainctl config.

chainctl events

Fri, 12 Jun 2026 17:28:47 +0000

chainctl events

Events related commands for the Chainguard platform.

chainctl events subscriptions

Fri, 12 Jun 2026 17:28:47 +0000

chainctl events subscriptions

Subscription interactions.

chainctl events subscriptions create

Fri, 12 Jun 2026 17:28:47 +0000

chainctl events subscriptions create

Subscribe to events under an organization or folder.

chainctl events subscriptions delete

Fri, 12 Jun 2026 17:28:47 +0000

chainctl events subscriptions delete

Delete a subscription.

chainctl events subscriptions list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl events subscriptions list

List subscriptions.

chainctl iam

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam

IAM related commands for the Chainguard platform.

chainctl iam account-associations

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam account-associations

Configure and manage cloud provider account associations.

chainctl iam account-associations check

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam account-associations check

Check the OIDC federation configurations for cloud providers.

chainctl iam account-associations check aws

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam account-associations check aws

Checks that the given location has been properly configured for OIDC federation with AWS

chainctl iam account-associations check azure

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam account-associations check azure

Checks that the given location has been properly configured for OIDC federation with AZURE

chainctl iam account-associations check gcp

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam account-associations check gcp

Checks that the given location has been properly configured for OIDC federation with GCP

chainctl iam account-associations describe

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam account-associations describe

Describe cloud provider account associations for a location.

chainctl iam account-associations set

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam account-associations set

Set cloud provider account associations for a location.

chainctl iam account-associations set aws

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam account-associations set aws

Set AWS account association for a location.

chainctl iam account-associations set azure

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam account-associations set azure

Set AZURE account association for a location.

chainctl iam account-associations set gcp

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam account-associations set gcp

Set GCP account association for a location.

chainctl iam account-associations unset

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam account-associations unset

Remove cloud provider account associations from a location.

chainctl iam account-associations unset aws

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam account-associations unset aws

Remove AWS account configuration for a location.

chainctl iam account-associations unset azure

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam account-associations unset azure

Remove AZURE account configuration for a location.

chainctl iam account-associations unset gcp

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam account-associations unset gcp

Remove GCP account configuration for a location.

chainctl iam external-group-role-mappings

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam external-group-role-mappings

Manage IdP group-to-role mappings.

chainctl iam external-group-role-mappings create

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam external-group-role-mappings create

Create an IdP group-to-role mapping.

chainctl iam external-group-role-mappings delete

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam external-group-role-mappings delete

Delete an IdP group-to-role mapping.

chainctl iam external-group-role-mappings list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam external-group-role-mappings list

List IdP group-to-role mappings.

chainctl iam folders

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam folders

IAM folders interactions.

chainctl iam folders delete

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam folders delete

Delete a folder.

chainctl iam folders describe

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam folders describe

Describe a folder.

chainctl iam folders list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam folders list

List folders under an organization.

chainctl iam folders update

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam folders update

Update a folder.

chainctl iam identities

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam identities

Identity management.

chainctl iam identities create

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam identities create

Create a new identity.

chainctl iam identities create aws

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam identities create aws

Create a new identity for an AWS IAM resource.

chainctl iam identities create aws role

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam identities create aws role

chainctl iam identities create aws role NAME --aws-account-id=ACCOUNT --aws-role-name=NAME [--aws-role-id=ID] [--aws-partition=PARTITION] [--parent=PARENT] [--description=DESC] [--role=ROLE,ROLE,...] [--output=id|json|table]

Examples

 # Create an assumable identity for an AWS IAM role.
chainctl iam identities create aws role my-aws-identity --aws-account-id=123456789012 --aws-role-name=my-role
# Create an assumable identity for an AWS IAM role. Bind it to the registry.pull role.
chainctl iam identities create aws role my-aws-identity --aws-account-id=123456789012 --aws-role-name=my-role --role=registry.pull
# Provide the unique ID of an AWS IAM role. This prevents the identity from being assumed if the role is deleted and then recreated with the same name.
chainctl iam identities create aws role my-aws-identity --aws-account-id=123456789012 --aws-role-name=my-role --aws-role-id=AROAEXAMPLEC2UL7LUB
# Create an assumable identity for an AWS IAM role in the aws-us-gov partition.
chainctl iam identities create aws role my-aws-identity --aws-partition=aws-us-gov --aws-account-id=123456789012 --aws-role-name=my-role

Options

 --aws-account-id string The ID of the AWS account.
--aws-partition string The partition in which the role is located. For instance: aws, aws-cn or aws-us-gov. (default "aws")
--aws-role-id string The unique ID of the IAM role.
--aws-role-name string The name of the IAM role.
-d, --description string The description of the resource.
-n, --name string Given name of the resource.
--parent string The name or id of the parent location to create this identity under.
--role strings A comma separated list of names or IDs of roles to bind this identity to (optional).
-y, --yes Automatic yes to prompts; assume "yes" as answer to all prompts and run non-interactively.

Options inherited from parent commands

 --api string The url of the Chainguard platform API. (default "https://console-api.enforce.dev")
--audience string The Chainguard token audience to request. (default "https://console-api.enforce.dev")
--config string A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly.
--console string The url of the Chainguard platform Console. (default "https://console.chainguard.dev")
--force-color Force color output even when stdout is not a TTY.
-h, --help Help for chainctl
--issuer string The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev")
--log-level string Set the log level (debug, info) (default "ERROR")
-o, --output string Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide]
-v, --v int Set the log verbosity level.

chainctl iam identities create aws user

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam identities create aws user

chainctl iam identities create aws user NAME --aws-account-id=ACCOUNT --aws-user-name=NAME [--aws-user-id=ID] [--aws-partition=PARTITION] [--parent=PARENT] [--description=DESC] [--role=ROLE,ROLE,...] [--output=id|json|table]

Examples

 # Create an assumable identity for an IAM user
chainctl iam identities create aws user my-aws-identity --aws-account-id=123456789012 --aws-user-name=my-user
# Create an assumable identity for an IAM user. Bind it to the registry.pull role.
chainctl iam identities create aws user my-aws-identity --aws-account-id=123456789012 --aws-user-name=my-user --role=registry.pull
# Provide the unique ID of the user. This prevents the identity from being assumed if the user is deleted and then recreated with the same name.
chainctl iam identities create aws user my-aws-identity --aws-account-id=123456789012 --aws-user-name=my-user --aws-user-id=AIDAEXAMPLEC2UL7LUB
# Create an assumable identity for a user in the aws-us-gov partition
chainctl iam identities create aws user my-aws-identity --aws-partition=aws-us-gov --aws-account-id=123456789012 --aws-user-name=my-user

Options

 --aws-account-id string The ID of the AWS account.
--aws-partition string The partition in which the user is located. For instance: aws, aws-cn or aws-us-gov. (default "aws")
--aws-user-id string The unique ID of the IAM user.
--aws-user-name string The name of the IAM user.
-d, --description string The description of the resource.
-n, --name string Given name of the resource.
--parent string The name or id of the parent location to create this identity under.
--role strings A comma separated list of names or IDs of roles to bind this identity to (optional).
-y, --yes Automatic yes to prompts; assume "yes" as answer to all prompts and run non-interactively.

Options inherited from parent commands

 --api string The url of the Chainguard platform API. (default "https://console-api.enforce.dev")
--audience string The Chainguard token audience to request. (default "https://console-api.enforce.dev")
--config string A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly.
--console string The url of the Chainguard platform Console. (default "https://console.chainguard.dev")
--force-color Force color output even when stdout is not a TTY.
-h, --help Help for chainctl
--issuer string The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev")
--log-level string Set the log level (debug, info) (default "ERROR")
-o, --output string Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide]
-v, --v int Set the log verbosity level.

chainctl iam identities create github

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam identities create github

chainctl iam identities create github NAME --github-repo=REPO [--github-ref=REF] [--github-audience=AUD] [--parent=PARENT] [--description=DESC] [--role=ROLE,ROLE,...] [--output=id|json|table]

Examples

 # Create a GitHub Actions identity for any branch in a repo
chainctl iam identities create github my-gha-identity --github-repo=my-org/repo-name --parent=eng-org
# Create a GitHub Actions identity for a given branch in a repo and bind to a role
chainctl iam identities create github my-gha-identity --github-repo=my-org/repo-name --github-ref=refs/heads/test-branch --role=owner

Options

 -d, --description string The description of the resource.
--github-audience string The audience for the GitHub OIDC token
--github-ref string The branch reference for the executing action (optional).
--github-repo string The name of a GitHub repo where the action executes.
-n, --name string Given name of the resource.
--parent string The name or id of the parent location to create this identity under.
--role strings A comma separated list of names or IDs of roles to bind this identity to (optional).
-y, --yes Automatic yes to prompts; assume "yes" as answer to all prompts and run non-interactively.

Options inherited from parent commands

 --api string The url of the Chainguard platform API. (default "https://console-api.enforce.dev")
--audience string The Chainguard token audience to request. (default "https://console-api.enforce.dev")
--config string A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly.
--console string The url of the Chainguard platform Console. (default "https://console.chainguard.dev")
--force-color Force color output even when stdout is not a TTY.
-h, --help Help for chainctl
--issuer string The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev")
--log-level string Set the log level (debug, info) (default "ERROR")
-o, --output string Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide]
-v, --v int Set the log verbosity level.

chainctl iam identities create gitlab

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam identities create gitlab

chainctl iam identities create gitlab NAME --project-path=GITLAB-GROUP/GITLAB-PROJECT --ref-type={tag|branch} [--ref=REF] [--parent=PARENT] [--description=DESC] [--role=ROLE,ROLE,...] [--output=id|json|table]

Examples

 # Create a Gitlab CI identity for any branch in a given Gitlab project
chainctl iam identities create gitlab my-gitlab-identity --project-path=my-group/my-project --ref-type=branch --parent=eng-org
# Create a Gitlab CI identity for a given branch in a Gitlab project and bind to a role
chainctl iam identities create gitlab my-gitlab-identity --project-path=my-group/my-project --ref-type=branch --ref=main --role=owner

Options

 -d, --description string The description of the resource.
-n, --name string Given name of the resource.
--parent string The name or id of the parent location to create this identity under.
--project-path string The name of a Gitlab project where the action executes in the form "group-name/project-name[/foo/bar]". You can use a "*" for project-name (or sub-projects) to match any project in the group.
--ref string The reference for the executing action. If left empty or "*", all references will match.
--ref-type string The type of reference for the executing action, must be either "tag" or "branch".
--role strings A comma separated list of names or IDs of roles to bind this identity to (optional).
-y, --yes Automatic yes to prompts; assume "yes" as answer to all prompts and run non-interactively.

Options inherited from parent commands

 --api string The url of the Chainguard platform API. (default "https://console-api.enforce.dev")
--audience string The Chainguard token audience to request. (default "https://console-api.enforce.dev")
--config string A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly.
--console string The url of the Chainguard platform Console. (default "https://console.chainguard.dev")
--force-color Force color output even when stdout is not a TTY.
-h, --help Help for chainctl
--issuer string The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev")
--log-level string Set the log level (debug, info) (default "ERROR")
-o, --output string Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide]
-v, --v int Set the log verbosity level.

chainctl iam identities delete

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam identities delete

Delete one or more identities.

chainctl iam identities describe

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam identities describe

View the details of an identity.

chainctl iam identities list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam identities list

List identities.

chainctl iam identities update

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam identities update

Update an identity

chainctl iam identity-providers

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam identity-providers

customer managed identity provider management

chainctl iam identity-providers create

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam identity-providers create

Create an identity provider

chainctl iam identity-providers delete

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam identity-providers delete

Delete an identity provider.

chainctl iam identity-providers list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam identity-providers list

List identity providers.

chainctl iam identity-providers update

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam identity-providers update

Update an identity provider

chainctl iam invites

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam invites

Manage invite codes that register identities with Chainguard.

chainctl iam invites create

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam invites create

Generate an invite code to identities with Chainguard.

chainctl iam invites delete

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam invites delete

Delete invite codes

chainctl iam invites list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam invites list

List organization and folder invites.

chainctl iam organizations

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam organizations

IAM organization interactions.

chainctl iam organizations delete

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam organizations delete

Delete an organization.

chainctl iam organizations describe

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam organizations describe

Describe an organization.

chainctl iam organizations list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam organizations list

List organizations.

chainctl iam role-bindings

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam role-bindings

IAM role-bindings resource interactions.

chainctl iam role-bindings create

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam role-bindings create

Create a role-binding

chainctl iam role-bindings delete

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam role-bindings delete

Delete a role-binding.

chainctl iam role-bindings list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam role-bindings list

List role-bindings.

chainctl iam role-bindings update

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam role-bindings update

Update a role-binding.

chainctl iam roles

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam roles

IAM role resource interactions.

chainctl iam roles capabilities

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam roles capabilities

IAM role capabilities

chainctl iam roles capabilities list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam roles capabilities list

List IAM role capabilities.

chainctl iam roles create

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam roles create

Create an IAM role.

chainctl iam roles delete

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam roles delete

Delete a custom IAM role.

chainctl iam roles list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam roles list

List IAM roles.

chainctl iam roles update

Fri, 12 Jun 2026 17:28:47 +0000

chainctl iam roles update

Update an IAM role.

chainctl images

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images

Images related commands for the Chainguard platform.

chainctl images advisories

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images advisories

Security advisory commands for images.

chainctl images advisories list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images advisories list

List security advisories for packages in an image.

chainctl images changelog

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images changelog

Show changelog for image history

chainctl images diff

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images diff

Diff images.

chainctl images entitlements

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images entitlements

Manage entitlements to registry repositories.

chainctl images entitlements list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images entitlements list

List registry entitlements of an organization.

chainctl images helm

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images helm

Helm chart related commands

chainctl images helm values

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images helm values

Generate relocation overrides for a Chainguard Helm chart

chainctl images history

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images history

Show history for a specific image tag.

chainctl images list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images list

List tagged images from Chainguard registries.

chainctl images repos

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images repos

Image repo related commands for the Chainguard platform.

chainctl images repos build

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images repos build

Manage custom image builds

chainctl images repos build apply

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images repos build apply

Apply a build config

chainctl images repos build edit

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images repos build edit

Edit a build config, optionally creating a new repo with –save-as

chainctl images repos build list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images repos build list

List build reports

chainctl images repos build logs

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images repos build logs

Get build logs

chainctl images repos create

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images repos create

Create an image repository.

chainctl images repos delete

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images repos delete

Remove an image repository.

chainctl images repos list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images repos list

List image repositories.

chainctl images repos update

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images repos update

Update image repositories.

chainctl images tags

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images tags

Tags related commands for images.

chainctl images tags list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images tags list

List tags from repositories using –parent, –public, or –repo flags.

chainctl images tags resolve

Fri, 12 Jun 2026 17:28:47 +0000

chainctl images tags resolve

Resolve tags for a specific image reference.

chainctl libraries

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries

Ecosystem library related commands.

chainctl libraries entitlements

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries entitlements

Manage entitlements to language ecosystem libraries.

chainctl libraries entitlements create

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries entitlements create

Create ecosystem library entitlements for an organization.

chainctl libraries entitlements delete

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries entitlements delete

Delete an ecosystem library entitlement from an organization.

chainctl libraries entitlements list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries entitlements list

List entitlements of an organization.

chainctl libraries packages

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries packages

Inspect Libraries packages.

chainctl libraries packages blocked

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries packages blocked

List blocked Libraries packages.

chainctl libraries policy

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries policy

Manage Libraries policies.

chainctl libraries policy binding

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries policy binding

Manage Libraries policy bindings.

chainctl libraries policy binding create

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries policy binding create

Create a Libraries policy binding.

chainctl libraries policy binding delete

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries policy binding delete

Delete a Libraries policy binding.

chainctl libraries policy binding list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries policy binding list

List Libraries policy bindings.

chainctl libraries policy binding update

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries policy binding update

Update a Libraries policy binding.

chainctl libraries policy create

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries policy create

Create a custom Libraries policy.

chainctl libraries policy delete

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries policy delete

Delete a custom Libraries policy.

chainctl libraries policy describe

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries policy describe

Describe a Libraries policy.

chainctl libraries policy disable

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries policy disable

Disable a Libraries policy for an organization.

chainctl libraries policy enable

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries policy enable

Enable a Libraries policy for an organization.

chainctl libraries policy list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries policy list

List Libraries policies.

chainctl libraries policy update

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries policy update

Update a custom Libraries policy.

chainctl libraries update-hashes

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries update-hashes

Update lockfile integrity hashes with Chainguard Libraries checksums

chainctl libraries verify

Fri, 12 Jun 2026 17:28:47 +0000

chainctl libraries verify

A tool to analyze the use of Chainguard Libraries in various artifacts

chainctl packages

Fri, 12 Jun 2026 17:28:47 +0000

chainctl packages

Interact with Chainguard packages

chainctl packages versions

Fri, 12 Jun 2026 17:28:47 +0000

chainctl packages versions

Package version related commands for the Chainguard platform.

chainctl packages versions list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl packages versions list

List version stream data for a managed package.

chainctl policies

Fri, 12 Jun 2026 17:28:47 +0000

chainctl policies

Manage policies.

chainctl policies binding

Fri, 12 Jun 2026 17:28:47 +0000

chainctl policies binding

Manage policy bindings.

chainctl policies binding create

Fri, 12 Jun 2026 17:28:47 +0000

chainctl policies binding create

Create a policy binding.

chainctl policies binding delete

Fri, 12 Jun 2026 17:28:47 +0000

chainctl policies binding delete

Delete a policy binding.

chainctl policies binding list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl policies binding list

List policy bindings.

chainctl policies check

Fri, 12 Jun 2026 17:28:47 +0000

chainctl policies check

Check an image against active policies.

chainctl policies describe

Fri, 12 Jun 2026 17:28:47 +0000

chainctl policies describe

Describe a policy and its parameter schema.

chainctl policies disable

Fri, 12 Jun 2026 17:28:47 +0000

chainctl policies disable

Disable a policy.

chainctl policies enable

Fri, 12 Jun 2026 17:28:47 +0000

chainctl policies enable

Enable a policy for an organization.

chainctl policies list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl policies list

List policies.

chainctl skills

Fri, 12 Jun 2026 17:28:47 +0000

chainctl skills

Skills registry related commands.

chainctl skills accept-terms

Fri, 12 Jun 2026 17:28:47 +0000

chainctl skills accept-terms

Accept legal terms required to publish skills.

chainctl skills delete

Fri, 12 Jun 2026 17:28:47 +0000

chainctl skills delete

Remove a published version of a skill.

chainctl skills describe

Fri, 12 Jun 2026 17:28:47 +0000

chainctl skills describe

Show metadata for a published skill.

chainctl skills entitlements

Fri, 12 Jun 2026 17:28:47 +0000

chainctl skills entitlements

Manage skills entitlements for an organization.

chainctl skills entitlements create

Fri, 12 Jun 2026 17:28:47 +0000

chainctl skills entitlements create

Create a skills entitlement for an organization.

chainctl skills entitlements delete

Fri, 12 Jun 2026 17:28:47 +0000

chainctl skills entitlements delete

Delete the skills entitlement from an organization.

chainctl skills entitlements list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl skills entitlements list

List skills entitlements of an organization.

chainctl skills install

Fri, 12 Jun 2026 17:28:47 +0000

chainctl skills install

Download a skill and install it into agent directories.

chainctl skills list

Fri, 12 Jun 2026 17:28:47 +0000

chainctl skills list

List skills published by an org.

chainctl skills pull

Fri, 12 Jun 2026 17:28:47 +0000

chainctl skills pull

Download a published skill to a local directory.

chainctl skills push

Fri, 12 Jun 2026 17:28:47 +0000

chainctl skills push

Package a skill directory and publish it to skills.cgr.dev.

chainctl skills uninstall

Fri, 12 Jun 2026 17:28:47 +0000

chainctl skills uninstall

Remove a skill from agent directories on the local machine.

chainctl skills validate

Fri, 12 Jun 2026 17:28:47 +0000

chainctl skills validate

Check a skill directory for spec compliance without making network calls.

chainctl skills versions

Fri, 12 Jun 2026 17:28:47 +0000

chainctl skills versions

List all published versions (tags) for a skill.

chainctl starter

Fri, 12 Jun 2026 17:28:47 +0000

chainctl starter

Manage catalog starter organizations

chainctl starter add-images

Fri, 12 Jun 2026 17:28:47 +0000

chainctl starter add-images

Add catalog images to your catalog starter organization.

chainctl starter init

Fri, 12 Jun 2026 17:28:47 +0000

chainctl starter init

Initialize a new catalog starter organization.

chainctl starter request-access

Fri, 12 Jun 2026 17:28:47 +0000

chainctl starter request-access

Request access to a catalog starter organization.

chainctl starter status

Fri, 12 Jun 2026 17:28:47 +0000

chainctl starter status

Show catalog starter organization status, quota, and image readiness.

chainctl update

Fri, 12 Jun 2026 17:28:47 +0000

chainctl update

Update chainctl.

chainctl version

Fri, 12 Jun 2026 17:28:47 +0000

chainctl version

Prints the version