CI/lock and rookery

Rookery is the modular attestation monorepo where CI/lock is built. It splits the attestation core, every individual attestor, every signer, and the binary builder into separate Go modules so each can be versioned and consumed independently.

Layout

The monorepo also hosts other CLIs that consume the same attestation core; this page focuses only on CI/lock.

Versioning

Rookery uses standard Go path-prefixed multi-module tags:

attestation/v0.1.0
plugins/attestors/git/v0.1.0
plugins/signers/file/v0.1.0

Each module can be released independently, so a fix to the git attestor doesn't force a release of the whole tree.

Why this matters for CI/lock

Because CI/lock is just main.go with a curated set of blank imports, you can build your own cilock binary with a different mix of attestors or signers — for example, adding kms/aws for an AWS-native pipeline, dropping cloud signers entirely for an air-gapped build, or adding sinkhole-flows or vsa, the two attestors the default binary leaves out. The rookery-builder generates a real CI/lock with your chosen plugins; the release pipeline is the template for a full multi-arch signed release build.

The default cilock binary ships every attestor except sinkhole-flows, vsa and the AWS attestors (aws-iid, aws-codebuild, aws-config; build with -tags aws_attestors), and three signers (file, fulcio, piv). The remaining seven signers (debug-signer, kms/aws, kms/gcp, kms/azure, spiffe, vault, vault-transit) are opt-in via rookery-builder --with <signer-module>. This keeps the prebuilt binary's transitive dependency tree about 600 Go packages smaller.

Presets

The presets/ modules are the easiest way to grab a curated set without writing imports yourself:

• presets/all — every attestor and signer in rookery
• presets/cicd — the CI/CD-relevant subset (attestors + file signer). This Go module is not the builder's --preset cicd, which is smaller: minimal plus github, gitlab and slsa, with no build-tool attestors such as maven or docker (see Presets)
• presets/minimal — commandrun, environment, git, material, product + file signer

The builder accepts a preset name (--preset cicd) and then layers --with <module> flags on top, so the typical "I need cicd plus KMS" build is one command. Add every attestor your steps name that the preset lacks, and check the result with cilock attestors list.

Licensing

Everything in rookery is Apache 2.0: the stock cilock CLI, the rookery builder, the builder's source, and every binary the builder produces. The repository has one LICENSE file at its root.

cilock license prints the Apache 2.0 text on every binary. A binary built with rookery-builder --customer <id> --tenant <id> also prints those values as branding lines under the license text; the license itself does not change.

A TestifySec platform subscription covers the hosted platform, not the CLI. You need no license from TestifySec to build, run, or redistribute a cilock binary.

Contributing

Both CI/lock and witness changes land here. See the rookery CONTRIBUTING guide for the workflow.