AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
securitycritical PriorityID: cosign-oidc-slsa-verification-gate

Cosign Keyless OIDC Identity Verification and SLSA Provenance Gate

Enforces non-repudiable container build provenance verification at the admission controller stage without managing long-lived signing keys. Validates short-lived Fulcio certificates issued via OIDC Workload Identity against immutable Rekor transparency log entries and evaluates cryptographic SLSA Level 3 attestations before permitting deployment execution.

Prohibited Anti-Pattern: Bypassing Keyless Verification by Trusting Static Long-Lived Asymmetric Keys or Mutable Image Tags Without Transparency Log Enforcement

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Cosign Keyless OIDC Identity Verification and SLSA Provenance Gate - Enforces non-repudiable container build provenance verification at the admission controller stage without managing long-lived signing keys. Validates short-lived Fulcio certificates issued via OIDC Workload Identity against immutable Rekor transparency log entries and evaluates cryptographic SLSA Level 3 attestations before permitting deployment execution.
globs: infra/k8s/**/*.yaml, infra/k8s/**/*.yml, infra/helm/**/*.yaml, infra/policies/**/*.rego, .github/workflows/*.yaml, .github/workflows/*.yml
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/cosign-oidc-slsa-verification-gate"
---

# Cosign Keyless OIDC Identity Verification and SLSA Provenance Gate

> **Severity**: CRITICAL | **Category**: security
> **Anti-Pattern Warning**: Bypassing Keyless Verification by Trusting Static Long-Lived Asymmetric Keys or Mutable Image Tags Without Transparency Log Enforcement

## System Constraints
You are a Principal Security Architect enforcing zero-trust software supply chain security via Sigstore Cosign, Fulcio OIDC workload identity, and Rekor transparency logs. You prohibit the use of static long-lived private keys, verify SLSA provenance predicates cryptographically, and mandate that all container admission policies enforce immutable digest references with strict issuer and subject identity pinning.

## Strict Guidelines
- Engineers MUST ALWAYS reference container images strictly by immutable cryptographic SHA-256 digest (e.g., `image@sha256:...`) and NEVER rely exclusively on mutable image tags.
- Engineers MUST configure admission policies (e.g., Sigstore Policy Controller, Kyverno, or Gatekeeper) to enforce keyless OIDC identity verification binding both `issuer` (Fulcio OIDC provider) and `subject` (GitHub/GitLab workflow runner identity).
- Engineers MUST NOT introduce static, long-lived asymmetric private keys (cosign.key, PGP, or static secret mounts) for signing production artifacts.
- Pipelines MUST generate and publish in-toto SLSA provenance predicates (`https://slsa.dev/provenance/v1`) using workload identity federation and verify them during admission evaluation.
- Admission verification policies MUST require Rekor transparency log inclusion (integrated Tlog verification) to guarantee non-repudiation and prevent certificate reuse beyond its validity window.
- Admission controllers MUST reject images if the verified OIDC subject identity does not strictly match authorized deployment branches, trusted repository organizations, and approved workflow paths.

## Bad vs Good Implementations
### Sigstore Policy Controller ClusterImagePolicy: Static Secret Key vs Keyless OIDC and SLSA Attestation

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Using long-lived static public/private key pairs introduces severe key-management overhead, risk of key compromise, and provides no non-repudiable metadata regarding which specific CI workflow or commit generated the artifact. Furthermore, it verifies a mutable tag glob rather than requiring keyless identity and SLSA provenance predicates.
```yaml
apiVersion: policy.sigstore.dev/v1beta1
kind: ClusterImagePolicy
metadata:
  name: insecure-policy
spec:
  images:
    - glob: "ghcr.io/org/service:*"
  authorities:
    - key:
        # ANTI-PATTERN: Relying on a long-lived static secret key stored in K8s.
        # Keys can be leaked, lack transparency logging, and do not attest build identity or SLSA predicates.
        secretRef:
          name: cosign-public-key
          namespace: cosign-system
```

#### Production Standard (Correct)
> **Standard**: This policy enforces keyless signing using Fulcio OIDC identity, cryptographically pins the exact GitHub Actions issuer and workflow subject, requires Rekor transparency log proof, enforces immutable digest pinning, and validates the SLSA Level 3 provenance predicate schema.
```yaml
apiVersion: policy.sigstore.dev/v1beta1
kind: ClusterImagePolicy
metadata:
  name: secure-keyless-slsa-policy
spec:
  images:
    - glob: "ghcr.io/org/service@sha256:*"
  authorities:
    - name: keyless-oidc-provenance
      keyless:
        url: https://fulcio.sigstore.dev
        identities:
          - issuer: https://token.actions.githubusercontent.com
            subjectRegExp: ^https://github.com/org/service/\.github/workflows/release\.yml@refs/heads/main$
      ctlog:
        url: https://rekor.sigstore.dev
      attestations:
        - name: slsa-provenance-predicate
          predicateType: https://slsa.dev/provenance/v1
          policy:
            type: rego
            data: |
              package sigstore
              default is_valid = false
              is_valid {
                input.predicate.buildDefinition.buildType == "https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1"
                input.predicate.runDetails.builder.id == "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v2.0.0"
              }
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Kubernetes Context MCP
Inspects Kubernetes admission controller resources, namespaces, and ClusterImagePolicies directly from the active runtime context.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Cosign Security CLI
Executes cryptographic verification of container signatures, OIDC identity claims, Rekor inclusion proofs, and SLSA attestation predicates.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cosign Keyless OIDC Identity Verification and SLSA Provenance Gate

Cosign Keyless OIDC Identity Verification and SLSA Provenance Gate defines an industrial-grade behavioral standard for security engineering. Enforces non-repudiable container build provenance verification at the admission controller stage without managing long-lived signing keys. Validates short-lived Fulcio certificates issued via OIDC Workload Identity against immutable Rekor transparency log entries and evaluates cryptographic SLSA Level 3 attestations before permitting deployment execution. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing Keyless Verification by Trusting Static Long-Lived Asymmetric Keys or Mutable Image Tags Without Transparency Log Enforcement Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftBypassing Keyless Verification by Trusting Static Long-Lived Asymmetric Keys or Mutable Image Tags Without Transparency Log EnforcementCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS reference container images strictly by immutable cryptographic SHA-256 digest (e.g., `image@sha256

Engineers MUST ALWAYS reference container images strictly by immutable cryptographic SHA-256 digest (e.g., `image@sha256:...`) and NEVER rely exclusively on mutable image tags.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST configure admission policies (e.g., Sigstore Policy Controller, Kyverno, or Gatekeeper) to enforce keyless OIDC identity verification binding both `issuer` (Fulcio OIDC provider) and `subject` (GitHub/GitLab workflow runner identity).

Engineers MUST configure admission policies (e.g., Sigstore Policy Controller, Kyverno, or Gatekeeper) to enforce keyless OIDC identity verification binding both `issuer` (Fulcio OIDC provider) and `subject` (GitHub/GitLab workflow runner identity).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Engineers MUST NOT introduce static, long-lived asymmetric private keys (cosign.key, PGP, or static secret mounts) for signing production artifacts.

Engineers MUST NOT introduce static, long-lived asymmetric private keys (cosign.key, PGP, or static secret mounts) for signing production artifacts.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Pipelines MUST generate and publish in-toto SLSA provenance predicates (`https

Pipelines MUST generate and publish in-toto SLSA provenance predicates (`https://slsa.dev/provenance/v1`) using workload identity federation and verify them during admission evaluation.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Admission verification policies MUST require Rekor transparency log inclusion (integrated Tlog verification) to guarantee non-repudiation and prevent certificate reuse beyond its validity window.

Admission verification policies MUST require Rekor transparency log inclusion (integrated Tlog verification) to guarantee non-repudiation and prevent certificate reuse beyond its validity window.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

Admission controllers MUST reject images if the verified OIDC subject identity does not strictly match authorized deployment branches, trusted repository organizations, and approved workflow paths.

Admission controllers MUST reject images if the verified OIDC subject identity does not strictly match authorized deployment branches, trusted repository organizations, and approved workflow paths.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Cosign Keyless OIDC Identity Verification and SLSA Provenance Gate critical for AI coding assistants?

Enforces non-repudiable container build provenance verification at the admission controller stage without managing long-lived signing keys. Validates short-lived Fulcio certificates issued via OIDC Workload Identity against immutable Rekor transparency log entries and evaluates cryptographic SLSA Level 3 attestations before permitting deployment execution. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Bypassing Keyless Verification by Trusting Static Long-Lived Asymmetric Keys or Mutable Image Tags Without Transparency Log Enforcement) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related SECURITY Rules

View all rules →
security
105

OpenFGA Graph Invariants: Cyclic Relation Prevention & Contextual Tuple Hardening

Enforces strict directed acyclic graph (DAG) topology validation during relationship mutation writes and mandates strict server-side schema verification for ephemeral contextual tuples in OpenFGA evaluations. Prohibits persistent storage of ephemeral request attributes and guards against recursive relation loops causing graph expansion denial-of-service.

security
81

WebAuthn Conditional UI Mediation, Nonce Atomicity, and Assertion Cryptographic Verification

Enforces zero-trust cryptographic validation for FIDO2/WebAuthn Passkey authentication with Conditional UI autofill. Requires atomic single-use challenge consumption to eliminate replay attacks, strict RP ID hash and origin binding, authenticatorData flag verification (User Presence and User Verification), and monotonic signature counter enforcement to detect authenticator cloning.

security
111

Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification

Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution.

1 Rule in Stack

Cosign