Attestor catalog
Every attestor compiled into the default cilock binary (verified against cilock 1.0.1's cilock attestors list output), with its predicate type URL, lifecycle phase, and a one-line summary. Per-attestor JSON schemas live upstream in the witness docs (linked in the table); cilock and witness use compatible schemas, with cilock attestation types namespaced under https://aflock.ai/attestations/<name>/v0.1 and witness types under https://witness.dev/attestations/<name>/v0.1. Cilock accepts both via legacy aliases. Several attestors emit upstream-typed predicates (SLSA, OpenVEX, in-toto link, SLSA VSA) instead of an aflock-namespaced one; those exact types are shown in the table.
Source of truth:
rookery/cilock/cmd/cilock/main.gofor the registered set; per-attestor source inrookery/plugins/attestors/<name>/.
The current binary registers 29 attestors (3 always-run, 2 default-on, 24 opt-in).
Inspecting your binary
# Full table of registered attestors with name, type URL, run type
cilock attestors list
# JSON Schema for a specific attestor's predicate
cilock attestors schema git
The (always run) and (default) markers in cilock attestors list show which attestors fire on every cilock run and which are enabled without being passed via --attestations.
Source & build context
| Name | Predicate type | Lifecycle | What it captures | Upstream schema |
|---|---|---|---|---|
git (default) | https://aflock.ai/attestations/git/v0.1 | prematerial | Commit hash, branch, tags, author, committer, dirty status, refs, remotes, parents | witness/git.md |
command-run (always run) | https://aflock.ai/attestations/command-run/v0.1 | execute | argv, exit code, stdout/stderr digests, optional ptrace openedfiles and syscall records | witness/command-run.md |
material (always run) | https://aflock.ai/attestations/material/v0.1 | material | Digests of all files in the working directory before the command runs | witness/material.md |
product (always run) | https://aflock.ai/attestations/product/v0.1 | product | Digests of files changed/created during execute (filtered by --attestor-product-include-glob / --attestor-product-exclude-glob) | witness/product.md |
environment (default) | https://aflock.ai/attestations/environment/v0.1 | prematerial | OS, kernel, env vars (sensitive vars obfuscated or filtered) | witness/environment.md |
configuration | https://aflock.ai/attestations/configuration/v0.1 | prematerial | Captures cilock's own runtime config for the step | (cilock-native) |
link | https://in-toto.io/attestation/link/v0.3 | postproduct | in-toto link statement format (legacy in-toto compat) | witness/link.md |
lockfiles | https://aflock.ai/attestations/lockfiles/v0.1 | prematerial | Hashes of detected lockfiles for package-manager integrity | witness/lockfiles.md |
CI platform identity
| Name | Predicate type | Lifecycle | What it captures | Upstream schema |
|---|---|---|---|---|
github-action | https://aflock.ai/attestations/github-action/v0.1 | execute | Workflow, job, run-id, actor, event, ref, SHA from GITHUB_* env | (cilock-native) |
github | https://aflock.ai/attestations/github/v0.1 | prematerial | GitHub OIDC token claims (audience, subject, repo, ref) | witness/github.md |
githubwebhook | https://aflock.ai/attestations/githubwebhook/v0.1 | postproduct | Inbound webhook payload digest for chain-of-custody | (cilock-native) |
gitlab | https://aflock.ai/attestations/gitlab/v0.1 | prematerial | GitLab CI JWT identity, pipeline, job, runner, ref | witness/gitlab.md |
jenkins | https://aflock.ai/attestations/jenkins/v0.1 | prematerial | Jenkins build identity and job context | witness/jenkins.md |
jwt | https://aflock.ai/attestations/jwt/v0.1 | prematerial | Generic JWT identity capture (used for non-built-in OIDC sources) | witness/jwt.md |
Cloud identity & infrastructure
| Name | Predicate type | Lifecycle | What it captures | Upstream schema |
|---|---|---|---|---|
aws | https://aflock.ai/attestations/aws/v0.1 | prematerial | AWS EC2 instance identity document, cryptographically validated against the AWS public key | witness/aws.md |
aws-codebuild | https://aflock.ai/attestations/aws-codebuild/v0.1 | prematerial | AWS CodeBuild project identity and build metadata | witness/aws-codebuild.md |
gcp-iit | https://aflock.ai/attestations/gcp-iit/v0.1 | prematerial | GCP Instance Identity Token, validated against GCP keys | witness/gcp-iit.md |
docker | https://aflock.ai/attestations/docker/v0.1 | postproduct | Docker buildx metadata file digests, image tags | witness/docker.md |
oci | https://aflock.ai/attestations/oci/v0.1 | postproduct | OCI image content from saved image tarball, layers, config, manifests | witness/oci.md |
k8smanifest | https://aflock.ai/attestations/k8smanifest/v0.2 | postproduct | Kubernetes manifest digests for deploy artifacts | witness/k8smanifest.md |
Security & compliance evidence
| Name | Predicate type | Lifecycle | What it captures | Upstream schema |
|---|---|---|---|---|
sbom | https://aflock.ai/attestations/sbom/v0.1 | postproduct | Parses CycloneDX or SPDX JSON files in the products and embeds the SBOM document. (When a CycloneDX SBOM is emitted as a standalone attestation via --attestor-sbom-export, its inner predicateType becomes https://cyclonedx.org/bom.) | witness/sbom.md |
sarif | https://aflock.ai/attestations/sarif/v0.1 | postproduct | Parses SARIF result files (CodeQL, Semgrep, gosec, Trivy, etc.). Outer predicate wraps the SARIF report at .report, so Rego policies use input.report.runs not input.runs. | witness/sarif.md |
slsa | https://slsa.dev/provenance/v1.0 | postproduct | Emits SLSA Provenance v1 from the cilock run context. Uses the upstream SLSA predicate type directly. | witness/slsa.md |
secretscan | https://aflock.ai/attestations/secretscan/v0.1 | postproduct | Gitleaks pattern scan with recursive base64/hex/URL decode (default maxDecodeLayers=3); --attestor-secretscan-fail-on-detection blocks the build on hits. See concepts → secretscan. | witness/secretscan.md |
vex | https://openvex.dev/ns | postproduct | Vulnerability Exploit Exchange, explicit vulnerability disposition statements. Uses the upstream OpenVEX predicate type. | witness/vex.md |
omnitrail | https://aflock.ai/attestations/omnitrail/v0.1 | prematerial | OmniTrail tooling trail (Linux/Darwin only; Windows builds excluded for this reason) | witness/omnitrail.md |
system-packages | https://aflock.ai/attestations/system-packages/v0.1 | prematerial | OS package inventory (deb/rpm/apk) | witness/system-packages.md |
policyverify | https://slsa.dev/verification_summary/v1 | verify | Records a SLSA Verification Summary Attestation (VSA) for the verify result. Verify-type attestor: runs only inside cilock verify; cannot be combined with run-type attestors in cilock run. | (cilock-native; see verify-in-a-release-gate) |
maven | https://aflock.ai/attestations/maven/v0.1 | prematerial | Maven build context (POM path defaults to pom.xml) and dependency declarations | witness/maven.md |
Always-run and default sets
Verified from rookery/cilock/internal/cmd/run.go + the live cilock attestors list:
- Always run (cannot be omitted, run on every
cilock run):material,product, andcommand-run(when args are provided). - Default attestation set (when
--attestationsis not specified):environment,git(comma-separated, per cobraStringSlicesemantics).
Pass additional attestors with --attestations "<a>,<b>,<c>" (comma-separated, not space). Cilock also accepts the legacy witness URL aliases via attestation.RegisterLegacyAliases(), called from cilock/cmd/cilock/main.go at startup.
Naming gotchas
The on-disk Go package name and the attestor's Name() aren't always identical. Use the Name() value when passing --attestations:
| Go package directory | Attestor Name() (use this in --attestations) |
|---|---|
plugins/attestors/commandrun/ | command-run |
plugins/attestors/githubaction/ | github-action |
plugins/attestors/aws-iid/ | aws |
Available in rookery but not in the default cilock binary
These attestors live in rookery/plugins/attestors/ but are not registered in the default cilock binary (some are imported but not registered, others aren't imported at all). To include them, build a custom binary using the rookery builder:
asff, aws-config, docker-bench, inspec, kube-bench, nessus, oscap, pip-install, prowler, sinkhole-flows, vsa
(Note: pip-install is blank-imported by cilock/cmd/cilock/main.go but does not appear in cilock attestors list output. Treat it as unavailable in the default binary; build via the rookery builder if you need it.)