# maven attestor

Source: https://www.testifysec.com/docs/cilock/attestors/maven

The cilock maven attestor parses a Maven pom.xml and signs the project coordinates and declared dependencies into in-toto evidence as a static, pre-build dependency record.

Parses a Maven `pom.xml` and records the project coordinates plus its declared dependencies as an attestation.

 

| Name | `maven` |
| --- | --- |
| Predicate type | `https://aflock.ai/attestations/maven/v0.1` |
| Lifecycle | `prematerial` |
| Default binary? | No |
| Category | build (primary)dependency-resolve |
| Recommended trace | off — no syscall tracing needed |
| Auto-attaches when | - prefile\_exists: pom.xml<br>- prefile\_exists: mvnw |

The facts in this box are generated from the CI/lock binary's own catalog (`cilock tools list`). Do not hand-edit — run `npm run gen:catalog`.

 

## What it captures

 

Fields are read directly out of the POM XML and emitted under these JSON keys:

 

- `groupid` — from `<project><groupId>`.
 - `artifactid` — from `<project><artifactId>`.
 - `version` — from `<project><version>`.
 - `projectname` — from `<project><name>`.
 - `dependencies` — array of objects from `<project><dependencies><dependency>`. Each entry exposes: 
  
  - `groupid` (`<groupId>`)
   - `artifactid` (`<artifactId>`)
   - `version` (`<version>`)
   - `scope` (`<scope>`)

 

The attestor also emits subjects: one `` `project:<groupId>/<artifactId>@<version>` `` entry for the project and one `` `dependency:<groupId>/<artifactId>@<version>` `` entry per declared dependency. Each subject's digest is the SHA-256 of that subject string.

 

## When to use

 

Run during the `prematerial` phase of a Maven build to lock in the declared coordinates and dependency set before compile/fetch. Pair with a `material` attestor if you also need to bind the resolved artifact bytes.

 

## Flags

 

| Flag | Default | Description |
| --- | --- | --- |
| `--attestor-maven-pom-path` | `pom.xml` | Path to the Project Object Model (POM) XML file used for the task being attested. |

 

## Output shape

 

```json
{
  "groupid": "com.example",
  "artifactid": "my-service",
  "version": "1.2.3",
  "projectname": "My Service",
  "dependencies": [
    {
      "groupid": "org.springframework",
      "artifactid": "spring-core",
      "version": "6.1.0",
      "scope": "compile"
    }
  ]
}
```

 

## Gotchas

 

- **Direct dependencies only.** Only entries under `<project><dependencies><dependency>` are captured. `<dependencyManagement>`, `<build><plugins>`, profile-scoped dependencies, and parent-inherited dependencies are not parsed. No transitive resolution is performed — the attestor never invokes Maven.
 - **No POM digest is recorded.** The attestor does not hash the `pom.xml` file itself; only the parsed coordinates and dependency list end up in the predicate. Capture the POM with a material attestor if you need to bind its bytes.
 - **No property/variable interpolation.** Values like `${project.version}` or `${revision}` are emitted verbatim as they appear in the XML; Maven's effective-POM substitution is not applied.
 - **Single POM only.** The flag accepts one path. Multi-module reactor builds need one attestation per module POM.
 - **Subjects are coordinate-string digests, not artifact digests.** Each `project:` / `dependency:` subject's SHA-256 is computed over the coordinate string itself, not over a resolved JAR.

 

## CLI example

 

Real `pom.xml` resolution: groupId, artifactId, version, declared dependencies extracted statically.

 

```bash
# In a directory containing pom.xml:
cilock run --step maven-build \
  --signer-file-key-path key.pem --outfile attestation.json --workingdir . \
  --attestations maven \
  -- mvn -q package 
```

 

Validated against a real `pom.xml` with declared dependencies. The attestor reads the pom statically; no Maven invocation needed. See the full real-data example at [https://github.com/aflock-ai/attestor-compliance-examples/tree/main/10-maven](https://github.com/aflock-ai/attestor-compliance-examples/tree/main/10-maven).

 

## See also

 

- [Catalog row](https://www.testifysec.com/docs/cilock/reference/attestor-catalog)
 - Upstream: [witness/maven.md](https://github.com/in-toto/witness/blob/main/docs/attestors/maven.md)

 

---

**This page is generated from the CI/lock tool catalog.** Don't edit it here — the source is [`attestation/detection/docs/maven.doc.md`](https://github.com/aflock-ai/rookery/edit/main/attestation/detection/docs/maven.doc.md) in [aflock-ai/rookery](https://github.com/aflock-ai/rookery). The same catalog powers `cilock tools show maven` in the CLI, so a single edit keeps the terminal and the website in sync.

[Edit this page →](https://github.com/aflock-ai/rookery/edit/main/attestation/detection/docs/maven.doc.md) ·  [Add a new tool →](https://github.com/aflock-ai/rookery/new/main/attestation/detection/docs)

When you open the pull request: if you are an **AI agent**, add the `ai-agent` label. If you are a **human**, add the `human` label.

Reference generated from the product documentation. Match commands and support details to your installed release.