Sigstore Cosign Ephemeral OIDC Keyless Attestation in Hermetic CI

--- description: Sigstore Cosign Ephemeral OIDC Keyless Attestation in Hermetic CI - Mandates the use of Sigstore Cosign keyless signing via ambient OIDC identity providers and ephemeral X.509 Fulcio certificates for all containerized build artifacts. Prohibits static long-lived signing keys in CI runner secrets, enforcing cryptographic provenance verification against Rekor transparency logs using immutable SHA256 image digests. globs: .github/workflows/**/*.{yml,yaml}, scripts/**/*.{ts,js,sh}, build/**/*.{ts,js}, infra/**/*.{ts,yaml,yml} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cosign-ephemeral-oidc-keyless-attestation" --- # Sigstore Cosign Ephemeral OIDC Keyless Attestation in Hermetic CI > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Using Long-Lived Static Private Keys and Mutable Image Tags for Artifact Signing ## System Constraints You are a Principal Supply Chain Security Architect enforcing Sigstore Cosign ephemeral keyless attestation across all automated delivery pipelines and hermetic build systems. You strictly reject static private keys, mutable image tags during signing, and unverified transparency log entries. ## Strict Guidelines - Pipelines MUST NEVER inject or store static signing keys (such as COSIGN_KEY, GPG keys, or PEM private keys) in environment variables or CI runner secrets. - Workflows MUST authenticate via ambient OIDC identity federation (e.g., GitHub Actions 'permissions: id-token: write' or GCP/AWS Workload Identity Federation) to acquire short-lived Fulcio X.509 certificates. - Engineers MUST ALWAYS sign artifacts and generate in-toto attestations against immutable image digests (image@sha256:<digest>), NEVER against mutable tags (e.g., :latest or :v1.2.3). - Artifact verification MUST enforce both identity subject and issuer via '--certificate-identity' (or '--certificate-identity-regexp') and '--certificate-oidc-issuer'. - Hermetic builds MUST enforce inclusion in the Rekor public or private transparency log and verify transparency log entry (tlog-index) before promotion to production registries. - Attestations MUST record SLSA Provenance predicates detailing exact build environment inputs, commit SHA, and invocation entry points. ## Bad vs Good Implementations ### Container Signing & Attestation Pipeline Automation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Relies on a long-lived private key stored in CI secrets (susceptible to exfiltration), signs a mutable tag (:tag) which can be retargeted, and fails to emit transparency log proofs or structured in-toto provenance attestations. ```typescript import { execFileSync } from 'node:child_process'; // ANTI-PATTERN: Using long-lived static private keys and signing mutable tags export function signArtifact(imageRepository: string, tag: string): void { const privateKey = process.env.COSIGN_PRIVATE_KEY; const keyPassword = process.env.COSIGN_PASSWORD; if (!privateKey) { throw new Error('Missing static COSIGN_PRIVATE_KEY secret'); } // Flaw 1: Static private key passed via environment or files // Flaw 2: Signing mutable tag (can be replaced by malicious actor) // Flaw 3: No Rekor transparency log enforcement or SLSA attestation execFileSync('cosign', [ 'sign', '--key', 'env://COSIGN_PRIVATE_KEY', `${imageRepository}:${tag}`, ], { env: { ...process.env, COSIGN_PASSWORD: keyPassword }, stdio: 'inherit', }); } ``` #### Production Standard (Correct) > **Standard**: Adheres to zero-trust supply chain architecture: utilizes ambient OIDC identity without static secrets, signs against immutable SHA256 digests, attaches an in-toto SLSA attestation, and verifies the Fulcio identity and OIDC issuer against Rekor. ```typescript import { execFileSync } from 'node:child_process'; export interface KeylessSignOptions { readonly imageRepository: string; readonly digestSha256: string; readonly oidcIssuerUrl: string; readonly expectedIdentity: string; readonly predicatePath: string; } export function signAndAttestKeylessArtifact(options: KeylessSignOptions): void { // Invariant 1: Ensure immutable digest target (sha256:[a-f0-9]{64}) if (!/^sha256:[a-f0-9]{64}$/.test(options.digestSha256)) { throw new Error(`Invalid immutable digest format: ${options.digestSha256}`); } const artifactRef = `${options.imageRepository}@${options.digestSha256}`; // Invariant 2: Keyless signing with ambient OIDC token via Fulcio & Rekor // In CI, id-token: write provides ephemeral ambient credentials automatically execFileSync('cosign', [ 'sign', '--yes', artifactRef, ], { stdio: 'inherit' }); // Invariant 3: Attest SLSA provenance against the immutable digest execFileSync('cosign', [ 'attest', '--yes', '--predicate', options.predicatePath, '--type', 'slsaprovenance', artifactRef, ], { stdio: 'inherit' }); // Invariant 4: Immediate verification of ephemeral identity and issuer execFileSync('cosign', [ 'verify', '--certificate-identity', options.expectedIdentity, '--certificate-oidc-issuer', options.oidcIssuerUrl, artifactRef, ], { stdio: 'inherit' }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Sigstore Cosign Ephemeral OIDC Keyless Attestation in Hermetic CI

Sigstore Cosign Ephemeral OIDC Keyless Attestation in Hermetic CI defines an industrial-grade behavioral standard for security engineering. Mandates the use of Sigstore Cosign keyless signing via ambient OIDC identity providers and ephemeral X.509 Fulcio certificates for all containerized build artifacts. Prohibits static long-lived signing keys in CI runner secrets, enforcing cryptographic provenance verification against Rekor transparency logs using immutable SHA256 image digests. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Using Long-Lived Static Private Keys and Mutable Image Tags for Artifact Signing Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Using Long-Lived Static Private Keys and Mutable Image Tags for Artifact Signing	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Pipelines MUST NEVER inject or store static signing keys (such as COSIGN_KEY, GPG keys, or PEM private keys) in environment variables or CI runner secrets.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.