Sigstore Cosign Keyless Ephemeral OIDC Workload Attestation Standard

--- description: Sigstore Cosign Keyless Ephemeral OIDC Workload Attestation Standard - Enforces keyless container image signing and in-toto provenance attestation using short-lived OpenID Connect (OIDC) identity tokens issued by CI/CD workload providers. Completely eliminates static signing keys by requiring Fulcio root CA certificate verification and Rekor transparency log proof validation at all image promotion gates. globs: .github/workflows/**/*.{yml,yaml}, .gitlab-ci.yml, infra/k8s/**/*.{yml,yaml}, scripts/deploy/**/*.{ts,js,sh}, src/deployment/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/sigstore-cosign-ephemeral-oidc-attestation-standard" --- # Sigstore Cosign Keyless Ephemeral OIDC Workload Attestation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Static Secret-Based Artifact Signing with Missing Transparency Log and Identity Constraints ## System Constraints You are a Principal Security Architect enforcing the Sigstore Cosign Ephemeral OIDC Workload Identity Attestation Standard. Mandate keyless signing via Fulcio and strict Rekor transparency log validation. Ensure static asymmetric private keys (COSIGN_KEY) are completely excised. Reject any deployment or promotion pipelines that permit unpinned certificate identities, bypassed transparency logs, or mutable container tags. ## Strict Guidelines - Engineers MUST NEVER use static, persistent private keys (e.g., COSIGN_KEY, AWS KMS static credentials) for container signing in CI/CD pipelines. - Engineers MUST utilize short-lived OIDC workload identity tokens issued directly by the hosting platform (GitHub Actions, GitLab CI, Google Cloud Workload Identity) with minimal granted scopes (e.g., id-token: write). - Promotion and admission verification MUST pin both the expected certificate identity (--certificate-identity or --certificate-identity-regexp) and certificate OIDC issuer (--certificate-oidc-issuer or --certificate-oidc-issuer-regexp). - Services MUST enforce cryptographic verification against the Rekor transparency log and verify inclusion proofs before marking artifacts as valid for deployment. - Engineers MUST reference all container images by immutable cryptographic digests (sha256:...) rather than mutable semantic tags when signing and verifying. - Pipelines MUST attach and verify in-toto SLSA provenance attestations alongside the raw signature using cosign attest / cosign verify-attestation. ## Bad vs Good Implementations ### Image Promotion Verification Gate #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Relies on a static public/private key pair prone to leakage, ignores the Rekor transparency log via --insecure-ignore-tlog, operates on a mutable tag rather than an immutable digest, and fails to validate OIDC SAN identity or issuer claims. ```typescript import { execSync } from 'child_process'; export function verifyAndPromoteImage(imageUri: string): void { // Anti-Pattern: Using static key and trusting mutable tag without issuer/identity constraints const publicKey = process.env.COSIGN_PUBLIC_KEY; if (!publicKey) { throw new Error('Missing static public key'); } // Vulnerable to tag mutation and key compromise, no transparency log enforcement execSync(`cosign verify --key env://COSIGN_PUBLIC_KEY --insecure-ignore-tlog ${imageUri}`); console.log(`Image ${imageUri} successfully verified and promoted.`); } ``` #### Production Standard (Correct) > **Standard**: Enforces immutable sha256 digest referencing, leverages Sigstore's ephemeral keyless verification using Fulcio certificate SAN identity, verifies Rekor transparency log inclusion proofs, and validates in-toto SLSA provenance. ```typescript import { execFileSync } from 'child_process'; interface VerificationConfig { imageDigestUri: string; expectedIssuer: string; expectedIdentity: string; } export function verifyAndPromoteImage(config: VerificationConfig): void { const digestPattern = /^.+@sha256:[a-f0-9]{64}$/; if (!digestPattern.test(config.imageDigestUri)) { throw new Error(`Rejected: Image must be pinned by sha256 digest: ${config.imageDigestUri}`); } // Ephemeral keyless verification: Enforces Fulcio CA SAN identity and Rekor tlog inclusion const args = [ 'verify', '--certificate-oidc-issuer', config.expectedIssuer, '--certificate-identity', config.expectedIdentity, config.imageDigestUri ]; try { execFileSync('cosign', args, { stdio: 'pipe' }); } catch (error) { throw new Error(`Supply chain gate failed: Cryptographic signature or Rekor inclusion invalid: ${error}`); } // Verify provenance attestation const attestationArgs = [ 'verify-attestation', '--type', 'slsaprovenance', '--certificate-oidc-issuer', config.expectedIssuer, '--certificate-identity', config.expectedIdentity, config.imageDigestUri ]; try { execFileSync('cosign', attestationArgs, { stdio: 'pipe' }); } catch (error) { throw new Error(`SLSA attestation verification failed: ${error}`); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Sigstore Cosign Keyless Ephemeral OIDC Workload Attestation Standard

Sigstore Cosign Keyless Ephemeral OIDC Workload Attestation Standard defines an industrial-grade behavioral standard for security engineering. Enforces keyless container image signing and in-toto provenance attestation using short-lived OpenID Connect (OIDC) identity tokens issued by CI/CD workload providers. Completely eliminates static signing keys by requiring Fulcio root CA certificate verification and Rekor transparency log proof validation at all image promotion gates. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Static Secret-Based Artifact Signing with Missing Transparency Log and Identity Constraints Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Static Secret-Based Artifact Signing with Missing Transparency Log and Identity Constraints	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST NEVER use static, persistent private keys (e.g., COSIGN_KEY, AWS KMS static credentials) for container signing in CI/CD pipelines.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.