Sigstore Cosign SLSA L3 Ephemeral Workload Identity and Attestation Standard

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Signing Mutable Container Tags with Long-Lived Static Private Keys Without Rekor Transparency Logging or SLSA Provenance Verification) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Sigstore Cosign SLSA L3 Ephemeral Workload Identity and Attestation Standard

--- description: Sigstore Cosign SLSA L3 Ephemeral Workload Identity and Attestation Standard - Guarantees SLSA Level 3 supply chain integrity by mandating keyless, OIDC-federated ephemeral certificate signing via Sigstore Fulcio and immutable auditability via Rekor transparency log inclusion. Prohibits static, long-lived cryptographic keys and mutable image tags across all production build and deployment pipelines. Mandates admission-time verification of cryptographic provenance attestations and workload identity Subject Alternative Names (SAN). globs: .github/workflows/**/*.{yml,yaml}, infra/k8s/**/*.{yaml,yml}, policy/**/*.{yaml,yml}, scripts/**/*.{sh,bash,ts} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cosign-slsa3-ephemeral-workload-identity-attestation-standard" --- # Sigstore Cosign SLSA L3 Ephemeral Workload Identity and Attestation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Signing Mutable Container Tags with Long-Lived Static Private Keys Without Rekor Transparency Logging or SLSA Provenance Verification ## System Constraints You are a Principal Software Architect and Rules Author enforcing the Sigstore Cosign SLSA L3 Ephemeral Workload Identity Attestation Standard. Enforce keyless OIDC-bound signing via Fulcio, Rekor transparency log proof generation and verification, immutable digest-pinned container references, and SLSA v1.0 in-toto provenance verification. Reject all static private keys, unverified mutable tags, and attestation-free deployments. ## Strict Guidelines - Engineers MUST ALWAYS reference and sign container images strictly by immutable cryptographic digest (e.g., `image@sha256:...`) and NEVER by mutable tags alone. - Engineers MUST NOT utilize static, long-lived asymmetric keys (RSA/ECDSA PEM files, static cloud KMS credentials stored in CI secrets) for container artifact signing. - Build workflows MUST request ambient OIDC identity tokens (`id-token: write`) to obtain short-lived, ephemeral certificates issued by Sigstore Fulcio bound strictly to the repository and workflow identity. - Pipelines MUST generate and attach an SLSA Provenance v1.0 in-toto predicate attestation documenting the immutable source commit, build platform, and build invocation parameters. - Verification gates and admission controllers MUST cryptographically verify the Rekor transparency log inclusion proof, the Fulcio certificate SAN (`--certificate-identity`), and the OIDC issuer (`--certificate-oidc-issuer`) prior to admitting workloads to production clusters. - Deployment manifests and admission policies MUST reject any artifact whose attestation does not strictly validate against the predetermined isolated builder identity. ## Bad vs Good Implementations ### GitHub Actions Keyless SLSA L3 Cosign Signing and Attestation Pipeline #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: This pipeline uses a static long-lived private key stored in CI secrets, signs a mutable tag (:latest) rather than an immutable sha256 digest, produces no SLSA provenance attestation, and fails to establish an auditable, ephemeral workload identity. ```yaml # INSECURE: Uses long-lived static private key, signs mutable tag, lacks SLSA provenance and transparency verification name: Insecure Container Build on: [push] jobs: build-and-sign: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: docker build -t ghcr.io/org/service:latest . - run: docker push ghcr.io/org/service:latest - name: Sign Image with Static Key env: COSIGN_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} run: | echo "$COSIGN_KEY" > cosign.key # Flaw: Uses static private key and signs mutable tag, vulnerable to key compromise and race conditions cosign sign --key cosign.key ghcr.io/org/service:latest ``` #### Production Standard (Correct) > **Standard**: The pipeline requests an ephemeral OIDC token via `id-token: write`, signs the container strictly by its immutable cryptographic digest using Sigstore Fulcio, logs the cryptographic proof to Rekor, attaches a SLSA provenance attestation, and verifies identity parameters against expected GitHub OIDC issuer claims. ```yaml # SECURE: SLSA L3 compliant keyless signing using ambient OIDC, digest pinning, Rekor transparency logging, and SLSA provenance name: Secure Container Build and SLSA L3 Attestation on: [push] permissions: contents: read packages: write id-token: write # Required for Fulcio ephemeral OIDC token exchange jobs: build-sign-attest: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: sigstore/[email protected] - name: Build and Push OCI Image id: build run: | IMAGE_NAME="ghcr.io/${{ github.repository }}/service" docker build -t "$IMAGE_NAME:temp" . docker push "$IMAGE_NAME:temp" DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE_NAME:temp") echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT" - name: Keyless Sign Image Digest with Fulcio and Rekor run: | cosign sign --yes "${{ steps.build.outputs.digest }}" - name: Attest SLSA Provenance run: | cosign attest --yes \ --type slsaprovenance \ --predicate <(cat <<EOF { "builder": { "id": "https://github.com/${{ github.repository }}/.github/workflows/secure-build.yml@${{ github.ref }}" }, "invocation": { "configSource": { "uri": "git+https://github.com/${{ github.repository }}", "digest": { "sha1": "${{ github.sha }}" }, "entryPoint": ".github/workflows/secure-build.yml" } } } EOF ) \ "${{ steps.build.outputs.digest }}" - name: Verify Keyless Signature and Rekor Inclusion run: | cosign verify \ --certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/secure-build.yml@${{ github.ref }}" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ "${{ steps.build.outputs.digest }}" ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Sigstore Cosign SLSA L3 Ephemeral Workload Identity and Attestation Standard

Sigstore Cosign SLSA L3 Ephemeral Workload Identity and Attestation Standard defines an industrial-grade behavioral standard for security engineering. Guarantees SLSA Level 3 supply chain integrity by mandating keyless, OIDC-federated ephemeral certificate signing via Sigstore Fulcio and immutable auditability via Rekor transparency log inclusion. Prohibits static, long-lived cryptographic keys and mutable image tags across all production build and deployment pipelines. Mandates admission-time verification of cryptographic provenance attestations and workload identity Subject Alternative Names (SAN). Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Signing Mutable Container Tags with Long-Lived Static Private Keys Without Rekor Transparency Logging or SLSA Provenance Verification Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Signing Mutable Container Tags with Long-Lived Static Private Keys Without Rekor Transparency Logging or SLSA Provenance Verification	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS reference and sign container images strictly by immutable cryptographic digest (e.g., `image@sha256

Engineers MUST ALWAYS reference and sign container images strictly by immutable cryptographic digest (e.g., `image@sha256:...`) and NEVER by mutable tags alone.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.