Sigstore Cosign Ephemeral OIDC Keyless Attestation Pipeline Invariant

--- description: "Sigstore Cosign Ephemeral OIDC Keyless Attestation Pipeline Invariant - Mandates cryptographic supply-chain security by prohibiting long-lived signing keys and enforcing ephemeral OIDC keyless signing via Sigstore (Fulcio and Rekor) across all build pipelines. Requires non-bypassable Kubernetes admission control (Kyverno or Ratify) verifying image digest provenance, identity issuer, and Rekor transparency log entries prior to container scheduling." globs: ".github/workflows/**/*.yml, .github/workflows/**/*.yaml, k8s/**/*.yaml, policies/**/*.yaml, deploy/**/*.yaml" alwaysApply: true license: "CC-BY-4.0" source: "https://agentrules.org/rules/sigstore-cosign-ephemeral-oidc-attestation-invariant" --- # Sigstore Cosign Ephemeral OIDC Keyless Attestation Pipeline Invariant > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Bypassing Provenance Verification or Using Long-Lived Static Private Keys for Container Signing ## System Constraints You are a Principal Security and DevOps Architect strictly enforcing the Sigstore Cosign Ephemeral OIDC Keyless Attestation Pipeline Invariant. Reject any implementation utilizing static private keys, mutable container tags without immutable digests, or unvalidated admission control policies. Ensure all image builds strictly issue short-lived identity tokens, record signatures into the Rekor transparency log, and validate identity assertions within Kubernetes admission webhooks. ## Strict Guidelines - Engineers MUST ALWAYS authenticate signing operations using ephemeral OIDC tokens generated by trusted identity providers (e.g., GitHub Actions id-token: write) exchanged via Sigstore Fulcio. - Engineers MUST NEVER generate, commit, or inject long-lived static private keys (e.g., COSIGN_KEY, GPG, PGP) into CI/CD pipeline secrets. - Pipelines MUST ALWAYS sign container images using the immutable SHA256 digest (`image@sha256:...`) and never rely solely on mutable tags. - Kubernetes clusters MUST ALWAYS enforce non-bypassable admission policies (e.g., Kyverno ClusterPolicy or Gatekeeper) using verifyImages to validate the Rekor transparency log, the expected OIDC issuer, and the subject identity. - Pipelines MUST attach in-toto provenance attestations (SLSA Provenance) to the image digest using `cosign attest` alongside the signature. - Admission policies MUST NEVER set failurePolicy to Ignore; verifyImages rules MUST be enforced with failurePolicy: Fail or Enforce validationFailureAction. ## Bad vs Good Implementations ### CI Signing & Admission Policy: Static Keys vs Keyless OIDC Attestation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Uses a long-lived private key stored in CI secrets (high risk of key compromise/exfiltration), signs a mutable tag instead of an immutable sha256 digest, skips transparency log (Rekor) recording, and contains no admission control verification. ```yaml # Anti-Pattern: Static private key signing in CI without Rekor transparency or Kyverno validation name: build-and-sign on: [push] jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: docker build -t myrepo/app:latest . - run: docker push myrepo/app:latest - name: Sign with static key env: COSIGN_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} run: | cosign sign --key env://COSIGN_KEY myrepo/app:latest ``` #### Production Standard (Correct) > **Standard**: Eliminates static secrets by requesting an ephemeral OIDC token via `id-token: write`. Cosign exchanges this token with Fulcio and records the cryptographic signature in the public Rekor transparency log against the exact SHA256 digest. Kyverno enforces signature and issuer validity at Kubernetes admission, blocking any unsigned or untrusted workloads. ```yaml # Compliant: Ephemeral OIDC Keyless Signing & Kyverno ClusterPolicy Enforcement name: build-and-sign on: [push] permissions: id-token: write contents: read packages: write jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: sigstore/[email protected] - name: Build and Push Image id: build-image run: | IMAGE_URI="ghcr.io/${{ github.repository }}:sha-${{ github.sha }}" docker build -t "$IMAGE_URI" . DIGEST=$(docker push "$IMAGE_URI" | grep 'digest:' | awk '{print $3}') echo "digest=${DIGEST}" >> $GITHUB_OUTPUT echo "image_uri=ghcr.io/${{ github.repository }}@${DIGEST}" >> $GITHUB_OUTPUT - name: Sign Image Digest Keylessly run: | cosign sign --yes "${{ steps.build-image.outputs.image_uri }}" --- # Kyverno In-Cluster Admission Policy apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: enforce-keyless-signature spec: validationFailureAction: Enforce rules: - name: verify-sigstore-oidc match: any: - resources: kinds: - Pod verifyImages: - imageReferences: - "ghcr.io/my-org/*" attestors: - entries: - keyless: issuer: "https://token.actions.githubusercontent.com" subjectRegexp: "^https://github.com/my-org/.*$" rekor: url: "https://rekor.sigstore.dev" ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Sigstore Cosign Ephemeral OIDC Keyless Attestation Pipeline Invariant

Sigstore Cosign Ephemeral OIDC Keyless Attestation Pipeline Invariant defines an industrial-grade behavioral standard for devops engineering. Mandates cryptographic supply-chain security by prohibiting long-lived signing keys and enforcing ephemeral OIDC keyless signing via Sigstore (Fulcio and Rekor) across all build pipelines. Requires non-bypassable Kubernetes admission control (Kyverno or Ratify) verifying image digest provenance, identity issuer, and Rekor transparency log entries prior to container scheduling. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing Provenance Verification or Using Long-Lived Static Private Keys for Container Signing Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Bypassing Provenance Verification or Using Long-Lived Static Private Keys for Container Signing	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS authenticate signing operations using ephemeral OIDC tokens generated by trusted identity providers (e.g., GitHub Actions id-token

Engineers MUST ALWAYS authenticate signing operations using ephemeral OIDC tokens generated by trusted identity providers (e.g., GitHub Actions id-token: write) exchanged via Sigstore Fulcio.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.