feat: add Sysinternals sigcheck output as a material type

app/cli/documentation/cli-reference.mdx

@@ -252,7 +252,7 @@ Options
 --annotation strings         additional annotation in the format of key=value
 --attestation-id string      Unique identifier of the in-progress attestation
 -h, --help                       help for add
---kind string                kind of the material to be recorded: ["ARTIFACT" "ASYNCAPI_SPEC" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CHAINLOOP_AI_AGENT_CONFIG" "CHAINLOOP_AI_CODING_SESSION" "CHAINLOOP_PR_INFO" "CHAINLOOP_RUNNER_CONTEXT" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "GITLEAKS_JSON" "GRAPHQL_SPEC" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "OPENAPI_SPEC" "OPENVEX" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "TWISTCLI_SCAN_JSON" "YELP_DETECT_SECRETS_BASELINE" "ZAP_DAST_ZIP"]
+--kind string                kind of the material to be recorded: ["ARTIFACT" "ASYNCAPI_SPEC" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CHAINLOOP_AI_AGENT_CONFIG" "CHAINLOOP_AI_CODING_SESSION" "CHAINLOOP_PR_INFO" "CHAINLOOP_RUNNER_CONTEXT" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "GITLEAKS_JSON" "GRAPHQL_SPEC" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "OPENAPI_SPEC" "OPENVEX" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "SYSINTERNALS_SIGCHECK" "TWISTCLI_SCAN_JSON" "YELP_DETECT_SECRETS_BASELINE" "ZAP_DAST_ZIP"]
 --name string                name of the material as shown in the contract
 --no-strict-validation       skip strict schema validation for structured materials (SBOM_CYCLONEDX_JSON, OPENAPI_SPEC, ASYNCAPI_SPEC)
 --registry-password string   registry password, ($CHAINLOOP_REGISTRY_PASSWORD)
@@ -3025,7 +3025,7 @@ Options
 --annotation strings          Key-value pairs of material annotations (key=value)
 -h, --help                        help for eval
 --input stringArray           Key-value pairs of policy inputs (key=value)
---kind string                 Kind of the material: ["ARTIFACT" "ASYNCAPI_SPEC" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CHAINLOOP_AI_AGENT_CONFIG" "CHAINLOOP_AI_CODING_SESSION" "CHAINLOOP_PR_INFO" "CHAINLOOP_RUNNER_CONTEXT" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "GITLEAKS_JSON" "GRAPHQL_SPEC" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "OPENAPI_SPEC" "OPENVEX" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "TWISTCLI_SCAN_JSON" "YELP_DETECT_SECRETS_BASELINE" "ZAP_DAST_ZIP"]
+--kind string                 Kind of the material: ["ARTIFACT" "ASYNCAPI_SPEC" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CHAINLOOP_AI_AGENT_CONFIG" "CHAINLOOP_AI_CODING_SESSION" "CHAINLOOP_PR_INFO" "CHAINLOOP_RUNNER_CONTEXT" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "GITLEAKS_JSON" "GRAPHQL_SPEC" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "OPENAPI_SPEC" "OPENVEX" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "SYSINTERNALS_SIGCHECK" "TWISTCLI_SCAN_JSON" "YELP_DETECT_SECRETS_BASELINE" "ZAP_DAST_ZIP"]
 --material string             Path to material or attestation file
 -p, --policy string               Policy reference (./my-policy.yaml, https://my-domain.com/my-policy.yaml, chainloop://my-stored-policy) (default "policy.yaml")
 --project string              Project name to use as engine context for chainloop.* built-ins

app/controlplane/api/workflowcontract/v1/crafting_schema.proto

@@ -165,6 +165,9 @@ message CraftingSchema {
       GRAPHQL_SPEC = 32;
       // detect-secrets baseline file https://github.com/Yelp/detect-secrets
       YELP_DETECT_SECRETS_BASELINE = 33;
+      // Sysinternals sigcheck output in CSV format
+      // https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck
+      SYSINTERNALS_SIGCHECK = 34;
     }
   }
 }

app/controlplane/api/workflowcontract/v1/crafting_schema_validations.go

@@ -41,6 +41,7 @@ var CraftingMaterialInValidationOrder = []CraftingSchema_Material_MaterialType{
 	CraftingSchema_Material_GITLAB_SECURITY_REPORT,
 	CraftingSchema_Material_GITLEAKS_JSON,
 	CraftingSchema_Material_YELP_DETECT_SECRETS_BASELINE,
+	CraftingSchema_Material_SYSINTERNALS_SIGCHECK,
 	CraftingSchema_Material_OPENAPI_SPEC,
 	CraftingSchema_Material_ASYNCAPI_SPEC,
 	CraftingSchema_Material_GRAPHQL_SPEC,

go.mod

@@ -458,7 +458,7 @@ require (
 	golang.org/x/net v0.54.0 // indirect
 	golang.org/x/sync v0.20.0
 	golang.org/x/sys v0.44.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/text v0.37.0
 	golang.org/x/time v0.15.0 // indirect
 	golang.org/x/tools v0.44.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect

pkg/attestation/crafter/api/attestation/v1/crafting_state.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2023-2025 The Chainloop Authors.
+// Copyright 2023-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -28,6 +28,7 @@ import (
 	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials/attestation"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials/jacoco"
 	materialsjunit "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials/junit"
+	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials/sigcheck"
 	intoto "github.com/in-toto/attestation/go/v1"
 	"google.golang.org/protobuf/types/known/structpb"
 )
@@ -143,6 +144,15 @@ func (m *Attestation_Material) GetEvaluableContent(value string) ([]byte, error)
 		if err != nil {
 			return nil, fmt.Errorf("failed to marshal to json Jacoco report file: %w", err)
 		}
+	case v1.CraftingSchema_Material_SYSINTERNALS_SIGCHECK:
+		report, ierr := sigcheck.Parse(rawMaterial)
+		if ierr != nil {
+			return nil, fmt.Errorf("failed to ingest sigcheck report: %w", ierr)
+		}
+		rawMaterial, err = report.JSON()
+		if err != nil {
+			return nil, fmt.Errorf("failed to marshal sigcheck report: %w", err)
+		}
 	}
 
 	// if raw material is empty (container images, for example), let's create an empty json

pkg/attestation/crafter/api/attestation/v1/crafting_state_test.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2023 The Chainloop Authors.
+// Copyright 2023-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -199,6 +199,19 @@ func TestGetEvaluableContentWithMetadata(t *testing.T) {
 			filename:  "testdata/sbom.cyclonedx.json",
 			testField: "bomFormat",
 		},
+		{
+			name: "sigcheck csv material",
+			material: &Attestation_Material{
+				MaterialType: schemaapi.CraftingSchema_Material_SYSINTERNALS_SIGCHECK,
+				M: &Attestation_Material_Artifact_{
+					Artifact: &Attestation_Material_Artifact{
+						Name: "name", Digest: "sha256:deadbeef", IsSubject: true,
+					},
+				},
+			},
+			filename:  "testdata/sigcheck-report.csv",
+			testField: "elements",
+		},
 	}
 
 	for _, tc := range cases {

pkg/attestation/crafter/api/attestation/v1/testdata/sigcheck-report.csv

@@ -0,0 +1,2 @@
+"Path","Verified","Date","Publisher","Company","Description","Product","Product Version","File Version","Machine Type"
+"c:\windows\system32\ntdll.dll","Signed","10:00 AM 1/1/2026","Microsoft Windows","Microsoft Corporation","NT Layer DLL","Microsoft Windows Operating System","10.0.19041.1","10.0.19041.1 (WinBuild.160101.0800)","64-bit"

pkg/attestation/crafter/materials/materials.go

@@ -289,6 +289,8 @@ func Craft(ctx context.Context, materialSchema *schemaapi.CraftingSchema_Materia
 		crafter, err = NewGitleaksReportCrafter(materialSchema, casBackend, logger)
 	case schemaapi.CraftingSchema_Material_YELP_DETECT_SECRETS_BASELINE:
 		crafter, err = NewDetectSecretsCrafter(materialSchema, casBackend, logger)
+	case schemaapi.CraftingSchema_Material_SYSINTERNALS_SIGCHECK:
+		crafter, err = NewSigcheckCrafter(materialSchema, casBackend, logger)
 	case schemaapi.CraftingSchema_Material_CHAINLOOP_AI_AGENT_CONFIG:
 		crafter, err = NewChainloopAIAgentConfigCrafter(materialSchema, casBackend, logger)
 	case schemaapi.CraftingSchema_Material_CHAINLOOP_AI_CODING_SESSION: