CLI Reference: jacs attest

The jacs attest command creates and verifies attestation documents from the command line. Attestation extends basic signing with structured claims, evidence references, and derivation chains.

jacs attest create

Create a signed attestation document.

Synopsis

jacs attest create --claims '<JSON>' [options]

Options

Examples

Create a basic attestation:

jacs attest create \
  --subject-type artifact \
  --subject-id "doc-001" \
  --subject-digest "abc123def456..." \
  --claims '[{"name": "reviewed_by", "value": "human", "confidence": 0.95}]'

Attestation with multiple claims:

jacs attest create \
  --subject-type agent \
  --subject-id "agent-abc" \
  --subject-digest "sha256hash..." \
  --claims '[
    {"name": "reviewed", "value": true, "confidence": 0.95},
    {"name": "source", "value": "internal_db", "assuranceLevel": "verified"}
  ]'

Lift an existing signed document to attestation:

jacs attest create \
  --from-document mydata.signed.json \
  --claims '[{"name": "approved", "value": true}]'

With evidence references:

jacs attest create \
  --subject-type artifact \
  --subject-id "report-456" \
  --subject-digest "def789..." \
  --claims '[{"name": "scanned", "value": true}]' \
  --evidence '[{
    "kind": "custom",
    "digests": {"sha256": "evidence-hash..."},
    "uri": "https://scanner.example.com/results/123",
    "collectedAt": "2026-03-04T00:00:00Z",
    "verifier": {"name": "security-scanner", "version": "2.0"}
  }]'

Write to file:

jacs attest create \
  --subject-type artifact \
  --subject-id "doc-001" \
  --subject-digest "abc123..." \
  --claims '[{"name": "ok", "value": true}]' \
  -o attestation.json

jacs attest verify

Verify an attestation document.

Synopsis

jacs attest verify <FILE> [options]

Arguments

Options

Examples

Basic verification (local tier):

jacs attest verify attestation.json

Output:

Attestation verification: VALID
  Signature: OK
  Hash: OK
  Signer: agent-id-abc123
  Algorithm: ring-Ed25519

Full verification:

jacs attest verify attestation.json --full

Output:

Attestation verification: VALID
  Signature: OK
  Hash: OK
  Signer: agent-id-abc123
  Algorithm: ring-Ed25519
  Evidence: 1 item(s) verified
    [0] custom: digest OK, freshness OK
  Chain: not present

JSON output (for scripting):

jacs attest verify attestation.json --json

Output:

{
  "valid": true,
  "crypto": {
    "signature_valid": true,
    "hash_valid": true,
    "signer_id": "agent-id-abc123",
    "algorithm": "ring-Ed25519"
  },
  "evidence": [],
  "chain": null,
  "errors": []
}

Verify with external keys:

jacs attest verify attestation.json --key-dir ./trusted_keys/

Pipe through jq:

jacs attest verify attestation.json --json | jq '.crypto'

Piping and Scripting Patterns

Create and verify in one pipeline

jacs attest create \
  --subject-type artifact \
  --subject-id "doc-001" \
  --subject-digest "abc..." \
  --claims '[{"name": "ok", "value": true}]' \
  -o att.json && \
jacs attest verify att.json --json | jq '.valid'

Check validity in a script

#!/bin/bash
set -e

RESULT=$(jacs attest verify "$1" --json 2>/dev/null)
VALID=$(echo "$RESULT" | jq -r '.valid')

if [ "$VALID" = "true" ]; then
    echo "Attestation is valid"
    exit 0
else
    echo "Attestation is INVALID"
    echo "$RESULT" | jq '.errors'
    exit 1
fi

Batch verify multiple attestations

for file in attestations/*.json; do
    echo -n "$file: "
    jacs attest verify "$file" --json | jq -r '.valid'
done

Exit Codes

Environment Variables

See Also

• Sign vs. Attest Decision Guide
• Attestation Tutorial
• Attestation Verification Results
• CLI Command Reference