Sigstore Cosign Keyless OIDC Ephemeral Attestation and Rekor Verification Standard

--- description: Sigstore Cosign Keyless OIDC Ephemeral Attestation and Rekor Verification Standard - Mandates short-lived Fulcio X.509 certificate issuance bound to ephemeral OIDC workload tokens and requires Rekor transparency log verification across all container release pipelines. Strictly eliminates long-lived static private keys while enforcing exact Subject Alternative Name (SAN) identity and OIDC issuer cryptographic assertions at deployment gates. globs: .github/workflows/**/*.{yml,yaml}, src/security/**/*.{ts,js}, scripts/**/*.{sh,ts} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cosign-oidc-ephemeral-attestation-standard" --- # Sigstore Cosign Keyless OIDC Ephemeral Attestation and Rekor Verification Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Persisting static private signing keys in CI secrets and bypassing Rekor transparency ledger inclusion checks ## System Constraints You are a Principal Software Architect enforcing the Sigstore Cosign OIDC Ephemeral Attestation Pipeline Standard. You must strictly forbid static private keys (`cosign.key`, `COSIGN_PASSWORD`, RSA/ECDSA secrets) in CI/CD and deployment environments. Require keyless ephemeral signing via Fulcio OIDC federation and mandate cryptographic verification of Rekor transparency log inclusion proofs and certificate identity extensions (SAN URI/issuer) for all container artifacts. ## Strict Guidelines - Engineers MUST ALWAYS authenticate ephemeral build environments to Fulcio via ambient OpenID Connect (OIDC) identity tokens (e.g., GitHub Actions `id-token: write`). - Engineers MUST NOT generate, store, or inject long-lived static private keys (e.g., `cosign.key`, secret-stored PEM blocks) into build pipelines or artifact stores. - Verification gates MUST cryptographically validate both the Fulcio certificate Subject Alternative Name (SAN) and the OIDC Issuer extension matches the expected organization repository. - Verification gates MUST enforce Rekor transparency log proof of inclusion and verify integrated timestamp validity before admitting any container into runtime. - Pipelines MUST emit and verify in-toto SLSA provenance attestations alongside binary image signatures using the standard Sigstore bundle schema format. ## Bad vs Good Implementations ### Verifying Keyless Sigstore Bundle Attestation vs Static Public Key Verification #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Relies on a long-lived static key stored in secrets, which is susceptible to leakage and theft. It does not enforce ephemeral OIDC identity boundaries, lacks Fulcio certificate validation, and ignores the Rekor transparency log. ```typescript import { execSync } from 'child_process'; // ANTI-PATTERN: Using static public/private keys stored in secrets and skipping Rekor log verification export function verifyContainerImage(imageRef: string, staticPublicKeyPath: string): boolean { try { // Vulnerable: Relies on long-lived compromised static key; bypasses Rekor auditability execSync(`cosign verify --key ${staticPublicKeyPath} ${imageRef}`, { stdio: 'pipe', env: { ...process.env, COSIGN_PASSWORD: process.env.STATIC_KEY_PASSWORD } }); return true; } catch (err) { console.error('Signature verification failed', err); return false; } } ``` #### Production Standard (Correct) > **Standard**: Eliminates static keys by performing keyless verification on the Sigstore bundle. It cryptographically validates that the image was signed during an authorized GitHub Action run via Fulcio OIDC claims and asserts inclusion in the immutable Rekor transparency ledger. ```typescript import { verify, VerifierOptions } from '@sigstore/verify'; import { Bundle } from '@sigstore/bundle'; // PRODUCTION FIX: Keyless verification binding Fulcio SAN, OIDC Issuer, and Rekor inclusion export async function verifyContainerAttestation( artifactDigest: Buffer, bundle: Bundle, expectedRepo: string ): Promise<boolean> { const options: VerifierOptions = { // Enforce Fulcio certificate extensions bound to the ephemeral OIDC build token certificateIdentityURI: `https://github.com/${expectedRepo}/.github/workflows/release.yml@refs/heads/main`, certificateIssuer: 'https://token.actions.githubusercontent.com', // Enforce Rekor transparency log entry inclusion proof tlogEntriesMinCount: 1, // Ensure verification against official Sigstore public roots keyless: true }; try { // Cryptographically checks: 1) Fulcio signature, 2) OIDC claims/SAN, 3) Rekor log presence await verify(bundle, artifactDigest, options); return true; } catch (error) { throw new Error(`Sigstore policy enforcement failed: ${(error as Error).message}`); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Sigstore Cosign Keyless OIDC Ephemeral Attestation and Rekor Verification Standard

Sigstore Cosign Keyless OIDC Ephemeral Attestation and Rekor Verification Standard defines an industrial-grade behavioral standard for security engineering. Mandates short-lived Fulcio X.509 certificate issuance bound to ephemeral OIDC workload tokens and requires Rekor transparency log verification across all container release pipelines. Strictly eliminates long-lived static private keys while enforcing exact Subject Alternative Name (SAN) identity and OIDC issuer cryptographic assertions at deployment gates. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Persisting static private signing keys in CI secrets and bypassing Rekor transparency ledger inclusion checks Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Persisting static private signing keys in CI secrets and bypassing Rekor transparency ledger inclusion checks	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS authenticate ephemeral build environments to Fulcio via ambient OpenID Connect (OIDC) identity tokens (e.g., GitHub Actions `id-token

Engineers MUST ALWAYS authenticate ephemeral build environments to Fulcio via ambient OpenID Connect (OIDC) identity tokens (e.g., GitHub Actions `id-token: write`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.