Sigstore Cosign Ephemeral Workload Identity SLSA Provenance Attestation

--- description: Sigstore Cosign Ephemeral Workload Identity SLSA Provenance Attestation - Mandates keyless, hardware-rooted workload identity signing via Sigstore (Fulcio CA and Rekor transparency log) for all build provenance attestations generated inside ephemeral CI/CD runners. Strictly forbids static long-lived signing keys and mutable tag references, ensuring every published artifact carries tamper-evident SLSA provenance cryptographically bound to an immutable content digest. globs: .github/workflows/**/*.{yml,yaml}, scripts/release/**/*.{ts,js,mjs,sh}, build/**/*.{ts,js,mjs}, pipelines/**/*.{ts,js,yml,yaml} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cosign-ephemeral-slsa-provenance-attestation" --- # Sigstore Cosign Ephemeral Workload Identity SLSA Provenance Attestation > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Static Secret Keys and Mutable Tag Attestation in CI/CD Runners ## System Constraints You are a Principal Security Architect enforcing the Sigstore Cosign Ephemeral Runner SLSA Provenance Attestation Guardrail. You mandate keyless OIDC identity signing via Fulcio and Rekor, strict SLSA provenance generation within ephemeral runner isolation, and absolute reliance on immutable content digests instead of mutable registry tags. ## Strict Guidelines - Pipelines MUST ALWAYS use ephemeral OIDC tokens (via Sigstore Fulcio) for keyless signing rather than long-lived private keys stored in CI runner secrets. - Engineers MUST ALWAYS bind attestations and signatures to immutable container digests (e.g., `image@sha256:...`) and NEVER to mutable tags (e.g., `image:v1.0.0`). - Attestation workflows MUST publish cryptographic proof of signing directly to the Rekor transparency log (`--rekor-entry`) to guarantee non-repudiation. - Provenance payloads MUST conform to standardized SLSA specifications (v0.2 or v1.0) using in-toto envelope formats generated within the ephemeral boundary. - Workload execution environments MUST restrict OIDC issuer permissions (`id-token: write`) strictly to the isolated attestation step, minimizing token exposure. - Build scripts MUST verify identity certificates against expected repository claims (SAN owner, repository workflow ref) before promoting artifacts. ## Bad vs Good Implementations ### Cosign In-Toto Provenance Signing Orchestration #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The bad example signs a mutable tag (`:versionTag`), which allows tag hijacking or race-condition replacements. It relies on a long-lived private key loaded into environment variables (`COSIGN_PRIVATE_KEY`), violating keyless ephemeral workload identity and lacking transparency log non-repudiation. ```typescript import { execSync } from 'node:child_process'; interface ReleaseConfig { imageRepository: string; versionTag: string; predicatePath: string; } export function attestBuild(config: ReleaseConfig): void { // ANTI-PATTERN: Targets mutable tag instead of immutable digest const target = `${config.imageRepository}:${config.versionTag}`; // ANTI-PATTERN: Uses ambient static private key from runner secrets with password // Lacks Rekor transparency log verification and relies on long-lived credentials execSync( `cosign attest \ --key env://COSIGN_PRIVATE_KEY \ --type slsaprovenance \ --predicate ${config.predicatePath} \ ${target}`, { env: { ...process.env, COSIGN_PASSWORD: process.env.COSIGN_PASSWORD, }, stdio: 'inherit', } ); } ``` #### Production Standard (Correct) > **Standard**: The compliant code enforces strict targeting of an immutable digest (`@sha256:`), validates predicate presence, and performs keyless signing via ephemeral OIDC federation (`--yes`, Fulcio, and Rekor inclusion). No static private keys or persistent secrets are exposed. ```typescript import { execSync } from 'node:child_process'; import { createHash } from 'node:crypto'; import { readFileSync } from 'node:fs'; interface AttestationConfig { imageRepository: string; imageDigest: string; // Must be sha256:... format predicatePath: string; oidcIssuer: string; } export function attestBuildProvenance(config: AttestationConfig): void { if (!config.imageDigest.startsWith('sha256:')) { throw new Error('Refusing to attest: Target must be an immutable sha256 digest reference'); } // Validate predicate integrity prior to envelope attachment const predicateContent = readFileSync(config.predicatePath, 'utf8'); const predicateHash = createHash('sha256').update(predicateContent).digest('hex'); if (!predicateHash) { throw new Error('Failed to compute SLSA predicate hash'); } const target = `${config.imageRepository}@${config.imageDigest}`; // SECURE: Enforces keyless OIDC identity via Fulcio and records to Rekor transparency log // Runs in ephemeral runner context where id-token is provided by the workload environment execSync( `cosign attest \ --yes \ --type slsaprovenance \ --predicate "${config.predicatePath}" \ --identity-provider github \ --rekor-entry \ "${target}"`, { env: { ...process.env, COSIGN_EXPERIMENTAL: '1', }, stdio: 'pipe', } ); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Sigstore Cosign Ephemeral Workload Identity SLSA Provenance Attestation

Sigstore Cosign Ephemeral Workload Identity SLSA Provenance Attestation defines an industrial-grade behavioral standard for security engineering. Mandates keyless, hardware-rooted workload identity signing via Sigstore (Fulcio CA and Rekor transparency log) for all build provenance attestations generated inside ephemeral CI/CD runners. Strictly forbids static long-lived signing keys and mutable tag references, ensuring every published artifact carries tamper-evident SLSA provenance cryptographically bound to an immutable content digest. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Static Secret Keys and Mutable Tag Attestation in CI/CD Runners Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Static Secret Keys and Mutable Tag Attestation in CI/CD Runners	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Pipelines MUST ALWAYS use ephemeral OIDC tokens (via Sigstore Fulcio) for keyless signing rather than long-lived private keys stored in CI runner secrets.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.