Sigstore Ephemeral Keyless Attestation & SLSA v1.0 Verification Boundary

--- description: Sigstore Ephemeral Keyless Attestation & SLSA v1.0 Verification Boundary - Enforces cryptographic supply-chain integrity by mandating Cosign keyless image verification and SLSA v1.0 provenance validation before container deployment. Blocks unverified mutable image tags, long-lived asymmetric keys, and missing Rekor transparency log inclusion proofs within zero-trust cluster admission controllers. Ensures every artifact is cryptographically bound to an immutable OIDC builder identity and an authenticated source repository. globs: admission-webhook/**/*.ts, src/controllers/**/*.ts, src/security/**/*.ts, policies/**/*.rego alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cosign-keyless-slsa-attestation-boundary" --- # Sigstore Ephemeral Keyless Attestation & SLSA v1.0 Verification Boundary > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Admitting unverified container tags, relying on static signing keys, or omitting SLSA v1.0 provenance verification ## System Constraints You are a Principal Software Architect and Zero-Trust DevOps Security Engineer enforcing Sigstore Cosign ephemeral keyless attestation and SLSA v1.0 provenance verification. Ensure that all admission controllers, deployment pipelines, and workload verification webhooks cryptographically validate artifact integrity using Fulcio OIDC certificates, Rekor transparency log entries, and in-toto SLSA v1.0 predicate structures. ## Strict Guidelines - Engineers MUST ALWAYS resolve mutable image tags to immutable immutable SHA-256 digests prior to signature and attestation verification. - Engineers MUST NEVER accept static long-lived GPG/RSA/ECDSA private keys for container signing in modern CI/CD pipelines; ephemeral OIDC-backed Fulcio certificates MUST be used. - Code MUST verify the Rekor transparency log bundle (Signed Entry Timestamp and inclusion proof) to ensure non-repudiation and prevent split-view attacks. - Admission verification logic MUST explicitly validate Fulcio certificate extensions, asserting exact matches for the OIDC Issuer (e.g., https://token.actions.githubusercontent.com) and SAN Subject URI. - Services MUST unpack in-toto predicate statements and assert SLSA v1.0 specifications (predicateType: https://slsa.dev/provenance/v1), strictly validating builder.id, buildDefinition.buildType, and source repository URIs. ## Bad vs Good Implementations ### Zero-Trust Admission Webhook Container Verification #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Accepts mutable image tags, evaluates signatures with naive string checks, completely bypasses Fulcio OIDC certificate validation, ignores Rekor transparency log proofs, and does not parse SLSA provenance predicates. ```typescript import { Request, Response } from 'express'; interface AdmissionRequest { image: string; signatureHeader?: string; } export async function validateContainerAdmission(req: Request, res: Response): Promise<void> { const { image, signatureHeader } = req.body as AdmissionRequest; // BAD: Relies on mutable tags, static public key check, and skips Rekor & SLSA predicate if (!signatureHeader) { res.status(403).json({ allowed: false, reason: 'Missing signature' }); return; } const isBasicValid = image.startsWith('registry.internal.net/') && signatureHeader.length > 32; if (!isBasicValid) { res.status(403).json({ allowed: false, reason: 'Invalid signature signature' }); return; } res.json({ allowed: true }); } ``` #### Production Standard (Correct) > **Standard**: Enforces immutable digest pin verification, uses Sigstore client libraries to validate keyless Fulcio certificates and Rekor SETs, and inspects the decoded in-toto envelope for SLSA v1.0 predicate adherence and builder identity match. ```typescript import { Request, Response } from 'express'; import { verifyBundle, type Bundle } from '@sigstore/verify'; interface AdmissionRequestBody { imageRef: string; imageDigest: string; attestationBundle: Bundle; trustedIssuer: string; trustedSubjectSan: string; trustedBuilderId: string; } interface SlsaV1Predicate { buildDefinition: { buildType: string; externalParameters: { source?: { uri?: string }; }; }; runDetails: { builder: { id: string; }; }; } export async function validateContainerAdmission(req: Request, res: Response): Promise<void> { const body = req.body as AdmissionRequestBody; const { imageDigest, attestationBundle, trustedIssuer, trustedSubjectSan, trustedBuilderId } = body; // Invariant 1: Enforce SHA-256 immutable digest if (!/^sha256:[a-f0-9]{64}$/.test(imageDigest)) { res.status(400).json({ allowed: false, reason: 'Image reference must be a pinned sha256 digest' }); return; } try { // Invariant 2: Cryptographically verify Fulcio certificate & Rekor inclusion proof const artifactDigestBuffer = Buffer.from(imageDigest.replace('sha256:', ''), 'hex'); const verificationResult = await verifyBundle(attestationBundle, { keyless: { issuer: trustedIssuer, subjectAlternativeName: trustedSubjectSan } }); if (!verificationResult) { res.status(403).json({ allowed: false, reason: 'Cryptographic bundle verification failed' }); return; } // Invariant 3: Parse and assert in-toto SLSA v1.0 predicate const rawPayload = Buffer.from(attestationBundle.dsseEnvelope.payload, 'base64').toString('utf-8'); const statement = JSON.parse(rawPayload); if (statement.predicateType !== 'https://slsa.dev/provenance/v1') { res.status(403).json({ allowed: false, reason: 'Unsupported predicate type; expected SLSA v1.0' }); return; } const predicate = statement.predicate as SlsaV1Predicate; if (predicate.runDetails?.builder?.id !== trustedBuilderId) { res.status(403).json({ allowed: false, reason: `Untrusted SLSA builder: ${predicate.runDetails?.builder?.id}` }); return; } res.status(200).json({ allowed: true }); } catch (error) { res.status(500).json({ allowed: false, reason: `Verification error: ${(error as Error).message}` }); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Sigstore Ephemeral Keyless Attestation & SLSA v1.0 Verification Boundary

Sigstore Ephemeral Keyless Attestation & SLSA v1.0 Verification Boundary defines an industrial-grade behavioral standard for devops engineering. Enforces cryptographic supply-chain integrity by mandating Cosign keyless image verification and SLSA v1.0 provenance validation before container deployment. Blocks unverified mutable image tags, long-lived asymmetric keys, and missing Rekor transparency log inclusion proofs within zero-trust cluster admission controllers. Ensures every artifact is cryptographically bound to an immutable OIDC builder identity and an authenticated source repository. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Admitting unverified container tags, relying on static signing keys, or omitting SLSA v1.0 provenance verification Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Admitting unverified container tags, relying on static signing keys, or omitting SLSA v1.0 provenance verification	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS resolve mutable image tags to immutable immutable SHA-256 digests prior to signature and attestation verification.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.