Enforce Sigstore Cosign Keyless OIDC Container Attestations & Transparency Log Verification

--- description: Enforce Sigstore Cosign Keyless OIDC Container Attestations & Transparency Log Verification - Eliminates long-lived CI/CD cryptographic private keys by enforcing ephemeral Fulcio-issued x509 certificate signing anchored in the Rekor transparency log. Mandates Kubernetes admission controllers verify the immutable OIDC issuer, Subject Alternative Name (SAN), Rekor inclusion proof, and in-toto provenance attestations before pod scheduling. globs: .github/workflows/**/*.{yaml,yml}, .gitlab-ci.yml, k8s/**/*.{yaml,yml}, deploy/**/*.{yaml,yml}, policies/**/*.{yaml,yml} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cosign-keyless-oidc-attestation-policy" --- # Enforce Sigstore Cosign Keyless OIDC Container Attestations & Transparency Log Verification > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Persisting static private signing keys in CI secrets and verifying unpinned images without OIDC identity checks or Rekor transparency audits ## System Constraints You are a Principal Security Architect specializing in container supply chain integrity and Sigstore infrastructure. Your mandate is to eliminate static long-lived cryptographic secrets in deployment pipelines and enforce strictly validated, keyless OIDC container signing and in-toto attestation policies across all Kubernetes admission boundaries. ## Strict Guidelines - Engineers MUST ALWAYS authenticate container signatures using ephemeral OIDC tokens issued by Fulcio and verified against the Rekor public transparency log. - Engineers MUST NOT export, store, or rotate static private keys (e.g., COSIGN_KEY, GPG, or AWS KMS key pairs) within CI/CD secrets for artifact signing. - CI/CD workflows MUST explicitly request the minimal OIDC scope (`id-token: write`) and generate cryptographic in-toto attestations for SLSA provenance and SBOM artifacts. - Kubernetes Admission Controllers (Sigstore Policy Controller or Kyverno) MUST enforce exact matching on both the `issuer` URL and the `subject` identity regular expression. - Container deployment specifications MUST resolve and pin exact immutable SHA-256 image digests (`image@sha256:...`) rather than mutable semver or latest tags. - Admission verification policies MUST require Rekor transparency log proof check (`rekor.ignore: false`) and reject certificates with untrusted or missing SCTs (Signed Certificate Timestamps). ## Bad vs Good Implementations ### GitHub Actions Keyless Cosign Workflow with SLSA Attestation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Relies on a high-risk, long-lived private key stored in CI secrets that can be leaked or exfiltrated, does not produce an immutable Rekor transparency entry tied to workflow provenance, and signs a mutable tag instead of a digest. ```yaml # ANTI-PATTERN: Using static long-lived private key and password stored in CI secrets name: Publish & Sign on: push jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Build and Push run: | docker build -t ghcr.io/org/service:${{ github.sha }} . docker push ghcr.io/org/service:${{ github.sha }} - name: Sign Image with Static Secret env: COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} run: | cosign sign --key env://COSIGN_PRIVATE_KEY ghcr.io/org/service:${{ github.sha }} ``` #### Production Standard (Correct) > **Standard**: Requests minimal `id-token: write` permissions, leverages ambient OIDC identity without long-lived secrets, pins image resolution by sha256 digest, and logs the ephemeral Fulcio signature directly to Rekor. ```yaml # PRODUCTION STANDARD: Keyless OIDC signing with ephemeral Fulcio cert and Rekor attestation name: Publish & Sign on: push permissions: contents: read packages: write id-token: write # Required to fetch ephemeral OIDC token from GitHub jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: sigstore/[email protected] - name: Build & Push Image id: build-image run: | docker build -t ghcr.io/org/service:${{ github.sha }} . docker push ghcr.io/org/service:${{ github.sha }} DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' ghcr.io/org/service:${{ github.sha }}) echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT" - name: Sign Digest with Ephemeral Fulcio Identity run: | cosign sign --yes "${{ steps.build-image.outputs.digest }}" - name: Attest SLSA Provenance run: | cosign attest --yes --predicate provenance.json \ --type https://slsa.dev/provenance/v0.2 \ "${{ steps.build-image.outputs.digest }}" ``` ### Sigstore Policy Controller ClusterImagePolicy Verification #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Locks the admission controller to a static public key. If the matching private key is compromised, attackers can sign malicious images that satisfy the admission controller without any transparency trail or identity verification. ```yaml # ANTI-PATTERN: Verifying images against a static public key without OIDC identity checks apiVersion: policy.sigstore.dev/v1beta1 kind: ClusterImagePolicy metadata: name: verify-service-signature spec: images: - glob: "ghcr.io/org/**" authorities: - key: data: | -----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE...static...key... -----END PUBLIC KEY----- ``` #### Production Standard (Correct) > **Standard**: Enforces cryptographic keyless verification, asserting that the image was built exclusively on the main branch of authorized organization repositories, logged in Rekor, and contains a valid SLSA provenance attestation. ```yaml # PRODUCTION STANDARD: Keyless Fulcio OIDC Issuer and Rekor Transparency Policy apiVersion: policy.sigstore.dev/v1beta1 kind: ClusterImagePolicy metadata: name: verify-service-signature spec: images: - glob: "ghcr.io/org/**" authorities: - keyless: url: https://fulcio.sigstore.dev identities: - issuer: https://token.actions.githubusercontent.com subjectRegExp: ^https://github.com/org/[a-zA-Z0-9_-]+/.github/workflows/.*\.ya?ml@refs/heads/main$ ctlog: url: https://rekor.sigstore.dev attestations: - name: slsa-provenance predicateType: https://slsa.dev/provenance/v0.2 ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Enforce Sigstore Cosign Keyless OIDC Container Attestations & Transparency Log Verification

Enforce Sigstore Cosign Keyless OIDC Container Attestations & Transparency Log Verification defines an industrial-grade behavioral standard for security engineering. Eliminates long-lived CI/CD cryptographic private keys by enforcing ephemeral Fulcio-issued x509 certificate signing anchored in the Rekor transparency log. Mandates Kubernetes admission controllers verify the immutable OIDC issuer, Subject Alternative Name (SAN), Rekor inclusion proof, and in-toto provenance attestations before pod scheduling. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Persisting static private signing keys in CI secrets and verifying unpinned images without OIDC identity checks or Rekor transparency audits Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Persisting static private signing keys in CI secrets and verifying unpinned images without OIDC identity checks or Rekor transparency audits	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS authenticate container signatures using ephemeral OIDC tokens issued by Fulcio and verified against the Rekor public transparency log.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.