Which artifact in production came from which commit, branch, and build?

reads the chalk mark embedded in the container, binary, or script and returns the correlated build metadata — committer, branch, package changes, and container base — that was captured at build time

Has this binary or container been altered since it was built?

checks the tamperproof chalk mark against the artifact to confirm whether the identifier and its signed contents still match what was recorded at build

What software components and versions actually shipped inside this artifact?

pulls the SBOM generated automatically during the build (via Docker's tooling or a Syft fallback) and ties it to the same chalk mark as the rest of the provenance data

Who or what signed off on this build, and can that signature be verified independently?

reports the Sigstore signature attached to the build attestation, pushed to the registry alongside the image, so the signer and integrity of the build can be checked outside the build environment

Where did this artifact actually run, and under what cloud context?

collects cloud-specific metadata at startup by probing common cloud metadata interfaces, giving a record of the runtime environment tied back to the same artifact

Can provenance data reach my monitoring systems when normal outbound HTTPS is blocked?

falls back to encoding chalk key values into DNS lookups when the primary delivery sink is unavailable, walking a configured chain of backup sinks until one succeeds

Chalk release history — The Cyber Toolchain

v1.2.0 Aug 11, 2026 · issue 054

Chalk v1.2.0 adds a DNS telemetry sink, sink fallback chains, per-chalk reporting, new runtime timing keys, and metadata headers on HTTP sinks.

└──▷ GET THIS VERSION

$ git clone --branch v1.2.0 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v1.2.0

└──▷ USE IT

Beacon chalk metadata over DNS in air-gapped or HTTPS-restricted environments, truncating the commit ID to fit within the 63-character DNS label limit.

con4m

func trunc16(v: string) {
  return slice(v, 0, 16)
}

sink_config my_dns_beacon {
  sink:               "dns"
  domain_template:    "{_COMMIT_ID}.{METADATA_ID}.beacons.example.com"
  dns_server:         "10.0.0.1:5353"
  require_chalk_mark: true
  normalize._COMMIT_ID.callback: func trunc16
}
subscribe("report", "my_dns_beacon")

Route reports to a regional failover API when the primary is down, so chalk delivery continues without manual intervention.

con4m

sink_config primary_api {
  sink:                 "post"
  uri:                  "https://api.us-east-1.example.com/report"
  disable_after_errors: 3
  fallback_sink_config: "backup_api"
}

sink_config backup_api {
  sink:                 "post"
  uri:                  "https://api.eu-west-1.example.com/report"
  disable_after_errors: 3
}

subscribe("report", "primary_api")

New dns sink type encodes chalk key values into DNS lookup hostnames via a domain_template with {KEY} placeholders, providing a telemetry channel for environments where HTTPS egress is restricted; supports dns_server, require_chalk_mark, and per-key normalize.<KEY>.callback fields in sink_config.
New fallback_sink_config field on all sink_config sections names a backup sink to use when the primary is unavailable or disabled; chalk walks the full fallback chain on each delivery failure, with each sink tracking its own disable_after_errors counter independently.
outconf sections now support per_chalk_reports: true and custom_report sections support per_chalk: true to emit one report per chalk mark instead of bundling all marks into a single report.
post, presign, and s3 sinks now automatically disable themselves on repeated errors via a configurable disable_after_errors: <int> threshold (default 3); 4xx responses (except 429) disable immediately, while 5xx, 429, and network errors increment a consecutive-failure counter.
post and presign sinks now send chalk metadata headers with every request: X-Chalk-Version, X-Chalk-Operation, X-Chalk-Action-Id, X-Content-Length, X-Chalk-Digest-Sha256, and X-Chalk-Attempt (1-based retry counter).

+5 more show less

presign sink now supports x-forward-headers: header names listed in that response header are copied from the redirect response into the upload PUT, enabling metadata injection (e.g. X-Amz-Meta-*) that cannot be encoded in the presigned URL.
New exec.nice config field sets the nice level (range 0-19, default 5) for the chalk reporting process after fork, reverted before postexec and heartbeat so each phase uses its own independent value.
Four new runtime host keys for timing and heartbeat tracking: _MONOTIME (monotonic clock at operation start, in ms), _SINCE_TIMESTAMP (wall-clock ms since process start), _SINCE_MONOTIME (monotonic ms since process start), and _HEARTBEAT_COUNT (1-based counter, present only in heartbeat reports).
Two new runtime artifact keys capture post-mark errors: _ERR_INFO (superset of ERR_INFO, full error log through end of operation) and _FAILED_KEYS (superset of FAILED_KEYS, includes post-build step failures); all report templates except report_all now subscribe to these instead of the chalk-time originals.
GitLab CI log output is now automatically wrapped in section_start/section_end markers with collapsed=true when GITLAB_CI is set, making chalk reports collapsible in the GitLab job log UI.

10 details in Everything

└──▷ BREAKING ON UPGRADE

!report_default, report_large, and insertion_default templates have had FAILED_KEYS removed and _FAILED_KEYS added; consumers reading FAILED_KEYS from these report templates must switch to _FAILED_KEYS.

v1.1.3 Jul 6, 2026 · release notes

Adds VCS working tree keys (VCS_MODIFIED_FILES, etc.) and git fetch timeout config fields.

└──▷ GET THIS VERSION

$ git clone --branch v1.1.3 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v1.1.3

Adds VCS_MODIFIED_FILES, VCS_UNTRACKED_FILES, VCS_DIFF_STAT, and VCS_DIFF_PATCH to expose git working tree state.
Adds git.fetch_connect_timeout and git.fetch_transfer_timeout config keys to control network timeouts.

2 details in Everything

v1.1.1 Jun 22, 2026 · release notes

Chalk v1.1.1 adds docker_context_upload to attach build context as OCI attestation and supports OCI Referrers API.

└──▷ GET THIS VERSION

$ git clone --branch v1.1.1 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v1.1.1

Adds docker_context_upload configuration under docker.docker_registry.<name>.docker_push.<name> to upload the build context as a .tar.gz layer attached to an OCI attestation manifest
Adds support for OCI Referrers API via new attestation_use_oci_tag config key to attach attestations using the subject field instead of legacy tags
Starts populating DOCKER_CHALK_ADDED_LABELS with labels injected during docker build, keyed by original name
FAILED_KEYS and _OP_FAILED_KEYS now store a list of error objects per key instead of a single object to record multiple distinct failures

4 details in Everything

└──▷ BREAKING ON UPGRADE

!FAILED_KEYS and _OP_FAILED_KEYS now store a list of error objects per key instead of a single object; consumers must handle the new list format

v1.1.0 Jun 8, 2026 · release notes

Chalk v1.1.0 adds S3 sink support, GGUF/safetensors codecs, caller attestation plugin, Docker registry push, Kubernetes operator integration, and configurable external tool timeouts.

└──▷ GET THIS VERSION

$ git clone --branch v1.1.0 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v1.1.0

└──▷ TRY IT

Ingest caller metadata into the artifact using an external daemon's attestation envelope

$ CHALK_CALLER_ATTESTATION='{"daemon": "crayon", "uid": 1001}' chalk exec ./myapp

Adds endpoint option to sink configuration for S3-compatible APIs
Adds native chalking support for Mach-O binaries with automatic signing via codesign or rcodesign when available on Linux
Adds gguf, safetensors, and sidecar codecs for marking ML model files in-place or via sidecar JSON
Adds caller attestation plugin ingesting JSON envelope via CHALK_CALLER_ATTESTATION or CHALK_CALLER_ATTESTATION_FILE environment variables
Removes docker.arch_binary_locations in favor of docker.arch_binary_locations_path for multi-platform architecture downloads

+4 more show less

Adds Docker registry push support with new docker.docker_registry, docker.docker_registry.<name>.docker_login_get, and docker.docker_registry.<name>.docker_push configuration sections
Adds Kubernetes operator integration populating _K8S_* environment variables during chalk exec for richer deployment metadata
Adds configurable execution timeout for external tools (syft, semgrep, trufflehog) via tool.<name>.<name>_timeout config key with GNU coreutils timeout wrapper
Adds Trufflehog .git directory size check threshold via tool.trufflehog.trufflehog_git_size_check and tool.trufflehog.trufflehog_git_size_limit

9 details in Everything

└──▷ BREAKING ON UPGRADE

!docker.arch_binary_locations is removed; use docker.arch_binary_locations_path for multi-platform architecture downloads

v1.0.0 Mar 24, 2026 · release notes

v1.0 adds chalk extract for registry attestation validation and new CI plugins

└──▷ GET THIS VERSION

$ git clone --branch v1.0.0 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v1.0.0

--log-format CLI argument added to match log_format configuration.
New configuration docker_log_level specifically to configure docker wrapping log verbosity level.
New configurations docker.busybox_container and docker.binfmt_container for pinning binfmt and busybox images.
Configuration docker.fallback_to_syft_sbom allows falling back to syft to collect image SBOM when native buildx is missing _IMAGE_SBOM.
New configuration keyspec.<key>.only_object_store forces key to be only reported via object store.

+4 more show less

New chalk plugins for collecting CI metadata for Jenkins, Buildkite, BitBucket, CircleCI, Azure DevOps, and TeamCity.
_OP_ANCESTOR_ARGVS reports all parent processes argv which allows to put chalk invocations within the context of CI scripts.
chalk extract can now extract chalk mark directly from registry.
All chalk attestations now use OCI Image and Distribution 1.1 spec.

9 details in Everything

└──▷ BREAKING ON UPGRADE

!ignore_unsigned_images, inform_if_cant_sign, and use_transparency_log configurations are removed as cosign is removed as external dependency.
!_IMAGE_ID metadata key is dropped; _CURRENT_HASH now references image same as docker references it.
!DOCKER_BASE_IMAGE_ID is replaced with DOCKER_BASE_IMAGE_CONFIG_DIGEST.
!_PROCESS_FD_INFO, _PROCESS_MOUNT_INFO, _OP_TCP_SOCKET_INFO, _OP_UDP_SOCKET_INFO, _OP_IPV4_INTERFACES, _OP_IPV4_ROUTES, _OP_IPV6_INTERFACES, _OP_IPV6_ROUTES, _OP_ARP_TABLE, and _PROCESS_DETAIL keys now have mixed-type values instead of all-strings.

v0.6.6 Feb 10, 2026 · release notes

Adds log_format config key to control log output format (json/plain/auto)

└──▷ GET THIS VERSION

$ git clone --branch v0.6.6 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.6.6

v0.6.4 Dec 12, 2025 · release notes

Chalk v0.6.4 adds BUILD_WORKFLOW_NAME, BUILD_WORKFLOW_PATH, BUILD_WORKFLOW_HASH, and BUILD_REF environment variables to build reports.

└──▷ GET THIS VERSION

$ git clone --branch v0.6.4 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.6.4

Adds BUILD_WORKFLOW_NAME, BUILD_WORKFLOW_PATH, and BUILD_WORKFLOW_HASH fields to describe the CI workflow used for a build.
Adds BUILD_REF field to expose the raw git ref of the build (e.g. refs/pull/5/merge).
Sanitizes git origin keys in reports to strip embedded basic auth credentials.

3 details in Everything

v0.6.1 Sep 23, 2025 · release notes

Adds BUILD_ATTEMPT env var and updates BUILD_URI format for GitHub Actions job-level tracking.

└──▷ GET THIS VERSION

$ git clone --branch v0.6.1 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.6.1

BUILD_ATTEMPT environment variable is now exposed in custom report context to capture the build attempt number previously embedded in BUILD_URI.
BUILD_URI environment variable value format changed to include both workflow ID and job ID (.../actions/runs/<workflow>/job/<job>) instead of referencing only the build attempt.
BUILD_ID environment variable now references the GitHub Actions job ID instead of the workflow ID.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!The format of the BUILD_URI environment variable has changed from a build-attempt reference to a URI containing both workflow and job IDs (.../actions/runs/<workflow>/job/<job>), which may break parsers expecting the previous short-form ID.
!BUILD_ID now resolves to the GitHub Actions job ID instead of the workflow ID, potentially changing logic that relied on the previous workflow-level identifier.

v0.6.0 Sep 9, 2025 · release notes

Chalk v0.6.0 adds X509 codec, postexec async collection, ZIP injection, env var scanning, and JSON logging

└──▷ GET THIS VERSION

$ git clone --branch v0.6.0 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.6.0

└──▷ USE IT

Inject the chalk binary into a ZIP archive for AWS Lambda deployment with size threshold.

shell

chalk insert --inject-binary-into-zip <archive.zip>

Disable environment variable scanning for artifacts if they contain sensitive data not relevant to the scan.

shell

chalk exec --no-env-vars <command>

Adds symlink_behavior_chalking, --chalk-symlink-behavior, symlink_behavior_non_chalking, and --scan-symlink-behavior to control symlink handling for chalked vs non-chalked paths.
Adds X509 codec that parses PEM/DER files and outputs metadata keys like _X509_SUBJECT, _X509_KEY_TYPE, _X509_NOT_BEFORE, _X509_NOT_AFTER. Configured via certs.filter_method, certs.always_scan_paths, certs.scan_no_extension, certs.scan_extensions, certs.ignore_filenames, certs.ignore_prefixes, and certs.ignore_extensions.
Adds asynchronous metadata collection after chalk exec via the postexec report, using configs docker.prep_postexec, exec.postexec.run, exec.postexec.fork, exec.postexec.nice, exec.postexec.access_watch.prep_tmp_path, exec.postexec.access_watch.initial_poll_time, exec.postexec.access_watch.initial_poll_interval, exec.postexec.access_watch.scan_codecs, and exec.postexec.access_watch.scan_paths.
Adds _OP_ARTIFACT_ACCESSED key to indicate if an artifact was accessed during operation.
Adds _OP_ARTIFACT_MOUNTED key to indicate if an artifact file is externally mounted.

+8 more show less

Adds _OP_ARTIFACT_PATH_WITHIN_VCTL key to report the path of the file in the git repo.
Adds environment variable scanning for artifacts (default on) with configurable env_vars setting or --[no-]env-vars flag, and adds _OP_ARTIFACT_ENV_VAR_NAME key.
Reports all IMDSv2 errors in FAILED_KEYS or _OP_FAILED_KEYS.
Adds ZIP archive injection support for AWS Lambda via config zip.inject_binary, zip.inject_binary_allowed_extensions (default .zip), and zip.inject_zip_size_threshold (default 50Mb), plus CLI flag --inject-binary-into-zip.
Enables setting rlimit for heartbeat processes via configuration.
Outputs logs in json format for non-interactive sessions, including fields chalk_version, chalk_commit, chalk_magic, timestamp, and msg.
Adds BUILD_UNIQUE_ID environment variable for GitHub jobs and caches external tool outputs within the same workflow job context.
Enables chalk.env to extract chalkmark from chalk.json in AWS Lambda environments where LAMBDA_TASK_ROOT is defined, and adds run-time keys mirroring _BUILD_* keys for non-chalking operations.

13 details in Everything

└──▷ BREAKING ON UPGRADE

!symlink_behavior config renamed to symlink_behavior_chalking.
!--symlink-behavior CLI flag renamed to --chalk-symlink-behavior.
!exec.heartbeat.* configs moved to singleton exec.heartbeat.* (e.g., exec.heartbeat.run, exec.heartbeat.rate).
!Configuration ignore_patterns now applies to all chalk operations, not just chalking ones.

v0.5.9 Aug 14, 2025 · release notes

Adds docker.update_dockerignore config to automate .dockerignore updates for legacy Docker builds.

└──▷ GET THIS VERSION

$ git clone --branch v0.5.9 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.5.9

v0.5.6 Apr 30, 2025 · release notes

Chalk v0.5.6 adds VCS_MISSING_FILES env var to detect uncommitted artifacts

└──▷ GET THIS VERSION

$ git clone --branch v0.5.6 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.5.6

VCS_MISSING_FILES environment variable exposes files tracked by version control that are missing on disk during artifact creation

1 detail in Everything

v0.5.5 Apr 15, 2025 · release notes

Adds AWS CodeBuild pipeline support, object store reporting, copy_report_template_keys function, and TCP socket status filtering

└──▷ GET THIS VERSION

$ git clone --branch v0.5.5 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.5.5

BUILD_ORIGIN_URI environment key reports the URI of the resource that originated the CI build.
Adds object_store_config to upload report keys to an external object store and reference them.
New copy_report_template_keys("source", "dest") function to duplicate keys between report templates.
network.tcp_socket_statuses config key filters which TCP socket statuses appear in _OP_TCP_SOCKET_INFO.

4 details in Everything

└──▷ BREAKING ON UPGRADE

!The tech_stack plugin and its associated configuration keys are removed.
!The _SIGNATURES field now contains the full cosign attestation payload instead of just the signature.

v0.5.4 Feb 19, 2025 · release notes

Chalk v0.5.4 adds run_secret_scanner_tools config and EXTERNAL_TOOL_DURATION env var for secret scanning and performance reporting

└──▷ GET THIS VERSION

$ git clone --branch v0.5.4 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.5.4

EXTERNAL_TOOL_DURATION environment variable reports external tool duration for each invocation.
run_secret_scanner_tools configuration option collects a new SECRET_SCANNER key, currently supporting only Trufflehog.

2 details in Everything

v0.5.0 Jan 8, 2025 · release notes

Chalk v0.5.0 adds Docker base image pinning, new annotation/layer keys, and registry URL support

└──▷ GET THIS VERSION

$ git clone --branch v0.5.0 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.5.0

└──▷ TRY IT

Correlate base images across builds by comparing layer compositions stored in chalkmarks.

$ grep '_IMAGE_LAYERS' chalkmark.json

Retrieve OCI-compliant web URLs for all images in a build to automate vulnerability lookup or provenance checks.

$ jq '._REPO_URLS' chalkmark.json

Access the full set of Docker annotations applied during the build for policy validation or documentation.

$ jq '.DOCKER_ANNOTATIONS' chalkmark.json

_IMAGE_LAYERS key collects image layer digests to allow correlating base images by matching layer combinations.
DOCKER_ANNOTATIONS provides all --annotations used in docker build; _IMAGE_ANNOTATIONS contains found annotations for an image in the registry.
New Docker base image keys: _OP_ARTIFACT_CONTEXT, DOCKER_BASE_IMAGE_REGISTRY, DOCKER_BASE_IMAGE_NAME, DOCKER_BASE_IMAGE_ID, DOCKER_BASE_IMAGE_METADATA_ID, DOCKER_BASE_IMAGE_CHALK, and _COLLECTED_ARTIFACTS for deeper base image visibility.
_REPO_LIST_DIGESTS enumerates known list digests; _REPO_URLS provides human-accessible OCI-compliant URLs for images.

4 details in Everything

└──▷ BREAKING ON UPGRADE

!_IMAGE_DIGEST and _IMAGE_LIST_DIGEST keys removed; use _REPO_DIGESTS or _REPO_LIST_DIGESTS instead.
!_REPO_DIGESTS format changed from a single digest string to an object mapping registry and image name to a list of digests.
!_REPO_TAGS behavior changed: builds without --push no longer populate tags, and the structure now maps tags to digests.
!DOCKER_BASE_IMAGES.name renamed to uri; added registry and name sub-keys for normalized URI components.
!DOCKER_COPY_IMAGES.name renamed to uri; added registry and name keys.
!DATE_AUTHORED, DATE_COMMITTED, DATE_TAGGED (and _DATE_* variants) now use ISO-8601 format and UTC timezone instead of local git format.
!Added TIMESTAMP_AUTHORED, TIMESTAMP_COMMITTED, TIMESTAMP_TAGGED fields reporting milliseconds since Unix epoch.

v0.4.14 Nov 11, 2024 · release notes

Adds _EXEC_ID key for cross-report correlation and a minimal heartbeat report template.

└──▷ GET THIS VERSION

$ git clone --branch v0.4.14 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.4.14

The _EXEC_ID key is now emitted on every command execution to uniquely identify the chalk process lifetime
Added a new heartbeat report template used as the default for heartbeat reports
Renamed configuration keys for embed attestation provider: attestation_key_embed.location is removed in favor of attestation_key_embed.filename, attestation_key_embed.save_path, and attestation_key_embed.get_paths

3 details in Everything

└──▷ BREAKING ON UPGRADE

!attestation_key_embed.location configuration key is removed; use attestation_key_embed.filename, attestation_key_embed.save_path, and attestation_key_embed.get_paths instead.
!chalk setup now requires an interactive shell to generate new key-material.

v0.4.13 Oct 10, 2024 · release notes

Chalk v0.4.13 adds new environment variable keys for exit codes, cloud vendor detection, failed metadata collection, partial traceroute IPs, and Dockerfile paths.

└──▷ GET THIS VERSION

$ git clone --branch v0.4.13 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.4.13

└──▷ USE IT

Check the exit code of a previous docker build operation via environment variables.

shell

echo "Build exit code: $_OP_EXIT_CODE"

Inspect which metadata keys failed to collect and why during a scan.

shell

echo "${FAILED_KEYS}" | jq .

Verify the Dockerfile path relative to the repository root for VCS integration.

shell

echo "$DOCKERFILE_PATH_WITHIN_VCTL"

Adds _OP_EXIT_CODE key to report the exit code of external commands like chalk docker build
Adds _OP_CLOUD_SYS_VENDOR key for reporting sys vendor file content used to identify cloud provider
Adds FAILED_KEYS and _OP_FAILED_KEYS metadata keys containing collected error details (code, message, description) for keys that could not be collected
Adds _NETWORK_PARTIAL_TRACEROUTE_IPS to collect local network subnet IPs in docker network-namespaced containers
Adds DOCKERFILE_PATH_WITHIN_VCTL key reporting the Dockerfile path relative to the VCS project root

5 details in Everything

v0.4.9 Jul 30, 2024 · release notes

Chalk v0.4.9 adds DOCKER_TARGET and other keys to the chalk mark; changes default template for build/push

└──▷ GET THIS VERSION

$ git clone --branch v0.4.9 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.4.9

mark_default chalk template is now used by docker build and docker push, changing default metadata in /chalk.json
New DOCKER_TARGET key added to the chalk mark, providing the name of the target being built
New DOCKER_BASE_IMAGES key added to the chalk mark, providing a breakdown of all base images
New DOCKER_COPY_IMAGES key added to the chalk mark, providing a breakdown of external COPY --from instructions

4 details in Everything

v0.4.5 Jun 14, 2024 · release notes

Adds BUILD_COMMIT_ID key to report the CI/CD triggering commit ID.

└──▷ GET THIS VERSION

$ git clone --branch v0.4.5 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.4.5

v0.4.2 Jun 5, 2024 · release notes

Adds _GCP_PROJECT_METADATA key and fallback Docker execution for external tools

└──▷ GET THIS VERSION

$ git clone --branch v0.4.2 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.4.2

Adds _GCP_PROJECT_METADATA as a new chalk key to hold GCP project metadata
Enables syft and semgrep to run via Docker when not installed on the host but Docker is available

2 details in Everything

v0.4.1 May 30, 2024 · release notes

Adds BUILD_ORIGIN_ID, BUILD_ORIGIN_KEY, BUILD_ORIGIN_OWNER_ID and BUILD_ORIGIN_OWNER_KEY chalk keys for CI/CD origin identification.

└──▷ GET THIS VERSION

$ git clone --branch v0.4.1 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.4.1

v0.4.0 May 29, 2024 · release notes

Chalk v0.4.0 adds multi-platform auto-download, provenance/SBOM keys, and chalk dump/load for config migration

└──▷ GET THIS VERSION

$ git clone --branch v0.4.0 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.4.0

└──▷ USE IT

Migrate your entire chalk configuration to a new machine or CI environment.

shell

chalk dump all | chalk load --replace --all -

chalk dump all command dumps all user configurations as JSON; use with chalk load --replace --all - to import them.
New configuration keys docker.download_arch_binary, docker.download_arch_binary_urls, and docker.arch_binary_locations_path control automatic multi-platform binary downloads for docker builds.
New key _IMAGE_PROVENANCE captures provenance JSON when an image is built with --provenance=true.
New key _IMAGE_SBOM captures SBOM JSON when an image is built with --sbom=true.
Docker base image details are now available via keys DOCKER_BASE_IMAGE, DOCKER_BASE_IMAGE_REPO, DOCKER_BASE_IMAGE_TAG, and DOCKER_BASE_IMAGE_DIGEST.

+2 more show less

Host operational context is accessible via _OP_HOST_SYSNAME, _OP_HOST_NODENAME, _OP_HOST_RELEASE, _OP_HOST_VERSION, and _OP_HOST_MACHINE.
Git repository metadata is available at runtime as keys _ORIGIN_URI, _BRANCH, _TAG, _COMMIT_ID, and others for cross-repo reporting.

7 details in Everything

└──▷ BREAKING ON UPGRADE

!Removed key _IMAGE_VIRTUAL_SIZE; was deprecated by docker.
!Removed key _IMAGE_LAST_TAG_TIME; scoped to local daemon.
!Removed key _IMAGE_STORAGE_METADATA;
!Removed key DOCKER_CHALK_TEMPORARY_TAG; chalk no longer adds temporary tags.
!Key _SIGNATURE is renamed to _SIGNATURES to support multiple cosign signatures.
!Key _OP_HOSTINFO is renamed to _OP_HOST_VERSION.
!Key _OP_NODENAME is renamed to _OP_HOST_NODENAME.
!Key HOSTINFO_WHEN_CHALKED is renamed to HOST_VERSION_WHEN_CHALKED.
!Key NODENAME_WHEN_CHALKED is renamed to HOST_NODENAME_WHEN_CHALKED.
!Field DOCKER_CHALK_ADDED_TO_DOCKERFILE changed from string to list.
!Field _IMAGE_STOP_SIGNAL changed from int to string.
!Removed config key extract.search_base_layers_for_marks.
!Removed config key load.update_arch_binaries and flag chalk load --update-arch-binaries.
!Config template push_default removed; push now uses insertion_default.

v0.3.4 Mar 18, 2024 · release notes

Chalk v0.3.4 adds con4m functions (memoize, auth_headers, parse_json), a get key provider, and optional command name for chalk exec

└──▷ GET THIS VERSION

$ git clone --branch v0.3.4 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.3.4

Adds get attestation key provider to retrieve key-material over API
Supports con4m function memoize to cache function callback results in chalk marks
Supports con4m function auth_headers to get auth headers for a specific auth config
Supports con4m function parse_json to parse JSON strings
chalk exec no longer requires --exec-command-name, using args directly instead

5 details in Everything

└──▷ BREAKING ON UPGRADE

!Config keys use_signing_key_backup_service, signing_key_backup_service_url, signing_key_backup_service_auth_config_name, signing_key_backup_service_timeout, and signing_key_location are removed; use new attestation.key_provider, attestation_key_embed.location, and attestation_key_backup.* settings instead

v0.3.3 Feb 26, 2024 · release notes

Adds COMMIT_MESSAGE and TAG_MESSAGE keys to chalk marks; improved CA store fallback

└──▷ GET THIS VERSION

$ git clone --branch v0.3.3 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.3.3

Adds COMMIT_MESSAGE key to chalk marks containing the most recent commit message
Adds TAG_MESSAGE key to chalk marks for annotated tags
Falls back to bundled Mozilla CA Store when system TLS certs are unavailable

3 details in Everything

v0.3.1 Jan 23, 2024 · release notes

Chalk v0.3.1 adds arm64 Linux support and removes --no-api-login flag

└──▷ GET THIS VERSION

$ git clone --branch v0.3.1 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.3.1

└──▷ BREAKING ON UPGRADE

!The --no-api-login flag is removed; passing it will now fail or be ignored as the setup flow no longer requires interactive OIDC authentication.

v0.3.0 Jan 18, 2024 · release notes

Chalk v0.3.0 adds presign sink, JWT/Basic auth for sinks, git context support, and new metadata fields.

└──▷ GET THIS VERSION

$ git clone --branch v0.3.0 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.3.0

Adds presign sink to allow uploads to S3 without hard-coded credentials in the chalk configuration
Adds JWT/Basic auth authentication options to sinks
Added support for git context for docker build commands
Added new git metadata fields about authored commit, committer, and tag
Added github_json_group for printing chalk marks in GitHub Actions

+3 more show less

Added docker.wrap_cmd to allow to customize whether CMD should be wrapped when ENTRYPOINT is missing in Dockerfile
Added minimal AWS lambda metadata collection. It includes only basic information about lambda function such as its ARN and its runtime environment
Added experimental support for detection of technologies used at chalk and runtime (programming languages, databases, servers, etc.)

8 details in Everything

└──▷ BREAKING ON UPGRADE

!_OP_CLOUD_METADATA is now a JSON object vs a string containing JSON data. In addition cloud metadata is now nested to allow to include more metadata about running cloud instances
!The signing key backup service has been completely overhauled and no longer uses the OIDC Device Code Flow to authenticate to the API. Instead a pre-generated API access token is passed in chalk profile and that value is used as the bearer token. The setup command still generates keys for signing but will no longer prompt with a QR code to authenticate to the API.
!As a result of the above the login and logout commands have been removed.
!CHALK_API_KEY renamed to CHALK_DATA_API_KEY
!use_secret_manager renamed to use_signing_key_backup_service
!secret_manager_url renamed to signing_key_backup_service_url
!secret_manager_timeout renamed to signing_key_backup_service_timeout

v0.2.2 Jan 18, 2024 · release notes

Chalk v0.2.2 adds --multi-platform flag for docker multi-platform builds

└──▷ GET THIS VERSION

$ git clone --branch v0.2.2 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.2.2

v0.2.0 Jan 18, 2024 · release notes

Chalk v0.2.0 adds module system, cloud metadata collection, and chalk login/logout commands

└──▷ GET THIS VERSION

$ git clone --branch v0.2.0 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.2.0

chalk help and chalk help <command> rendering engine is now functional
chalk login command for OIDC authentication with the secret manager
chalk logout command to clear auth session
Initial metadata collection for GCP and Azure cloud providers via new metadata keys
docker.wrap_entrypoint = true config key to wrap Docker entrypoints when USER directive is present

5 details in Everything

v0.1.2 Jan 18, 2024 · release notes

First open source release of Chalk with automatic signing, chalk exec runtime beaconing, and new data collection modules.

└──▷ GET THIS VERSION

$ git clone --branch v0.1.2 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.1.2

└──▷ TRY IT

Initialize Chalk for automatic signing using the hosted secret service and generate a keypair

$ chalk setup

Run a container with Chalk to enable runtime beaconing and periodic heartbeat reports

$ chalk exec my-image

Configure Chalk to use an existing secret via environment variable instead of the Crash Override API

$ chalk setup --no-api-login

Adds the chalk setup command to initialize secrets, generate keypairs via Crash Override's secret service, and configure automatic signing
Adds the --no-api-login flag to chalk setup for users who provide their own secret via environment variable instead of using the hosted service
Adds the chalk exec command to inject beacon data into container entry points for runtime metadata collection
Enables periodic heartbeat reports from chalk exec to collect metadata about running workloads after startup
Adds an AWS IMDSv2 collection module with associated metadata keys for cloud environment data

+3 more show less

Adds a proc file system collection module for capturing process-level metadata
Injects environment variables into docker images in addition to the previously supported labels
Places ELF Chalk marks into their own ELF section so they survive strip operations

8 details in Everything

└──▷ BREAKING ON UPGRADE

!Config file format changed; existing preview configuration files may require migration

Chalk

Summary

How Chalk helps

Languages

Features

What Chalk offers you

release 14 total

docs

example

release 15 total

example

release 8 total

example

release

example

release

release

example

release

release

release

release

release

release

release

example

release

release

release

release

example

release

release

release

release

release

release

example

Command line

Score card

Trajectory

Release-note detail over time

Website history

Rebranding timeline

Releases

Project health

Add the badge to your README