Sigstore Cosign & In-Toto SLSA Level 3 Cryptographic Provenance Invariant

Enforces strict keyless cryptographic signature verification and in-toto SLSA Level 3 provenance validation inside admission controllers (such as Kyverno or Sigstore Policy Controller) before any pod is scheduled in production. Workloads must resolve to immutable sha256 digests bound to ephemeral OIDC identity certificates rooted in Fulcio and recorded in the Rekor transparency log. Rejects mutable tags, unsigned blobs, and non-hardened builder environments lacking verifiable source-to-binary attestation.

--- description: Sigstore Cosign & In-Toto SLSA Level 3 Cryptographic Provenance Invariant - Enforces strict keyless cryptographic signature verification and in-toto SLSA Level 3 provenance validation inside admission controllers (such as Kyverno or Sigstore Policy Controller) before any pod is scheduled in production. Workloads must resolve to immutable sha256 digests bound to ephemeral OIDC identity certificates rooted in Fulcio and recorded in the Rekor transparency log. Rejects mutable tags, unsigned blobs, and non-hardened builder environments lacking verifiable source-to-binary attestation. globs: **/*.yaml, **/*.yml, **/k8s/**/*.yaml, **/kyverno/**/*.yaml, .github/workflows/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/sigstore-cosign-slsa-level-3-provenance-guardrail" --- # Sigstore Cosign & In-Toto SLSA Level 3 Cryptographic Provenance Invariant > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Admitting Unsigned Containers or Unverified Build Provenance into Production Clusters ## System Constraints You are a Principal Software Architect enforcing zero-trust container supply chain security using Sigstore Cosign and SLSA Level 3 provenance attestations. Mandate cryptographic non-repudiation, immutable digest enforcement, and strict policy-based admission control. ## Strict Guidelines - Engineers MUST ALWAYS reference container images using immutable SHA-256 digests (`image@sha256:...`) rather than mutable semantic tags (`image:latest`, `image:v1.2.0`). - Admission controllers MUST verify keyless Cosign signatures using Fulcio OIDC certificates matching the exact CI repository SAN and OIDC issuer URL. - Admission policies MUST validate In-Toto SLSA Provenance predicates (SLSA v0.2/v1.0) to guarantee the artifact was produced by an isolated, trusted builder (e.g., GitHub Actions reusable workflow builder). - Engineers MUST NOT configure static PGP/RSA public keys for long-term production signing; keyless Fulcio/Rekor workflows are strictly mandated to eliminate private key exposure. - Workloads MUST be rejected immediately at the Kubernetes API admission boundary if Rekor transparency log entries or valid cryptographic attestations are missing or unparseable. ## Bad vs Good Implementations ### Kyverno ClusterPolicy verifying Cosign Keyless Signature and SLSA Level 3 Attestation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Fails to enforce cryptographic identity, uses non-blocking Audit mode, allows unverified mutable tags, and provides zero supply chain protection against compromised registries or forged build binaries. ```yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: weak-image-policy spec: validationFailureAction: Audit rules: - name: allow-mutable-images match: resources: kinds: - Pod validate: message: "Images should not use latest tag" pattern: spec: containers: - image: "!*:latest" ``` #### Production Standard (Correct) > **Standard**: Enforces synchronous admission rejection (Enforce mode), pins cryptographic verification to Sigstore keyless OIDC, validates Rekor log transparency, mutations to sha256 digests, and mandates non-forgeable SLSA Level 3 provenance from the official builder. ```yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: enforce-slsa-l3-cosign spec: validationFailureAction: Enforce webhookTimeoutSeconds: 30 rules: - name: verify-signature-and-provenance match: any: - resources: kinds: - Pod verifyImages: - imageReferences: - "ghcr.io/enterprise-corp/*" mutateDigest: true verifyDigest: true required: true keyless: issuer: "https://token.actions.githubusercontent.com" subject: "https://github.com/enterprise-corp/*/.github/workflows/*@refs/heads/main" rekor: url: "https://rekor.sigstore.dev" attestations: - predicateType: "https://slsa.dev/provenance/v0.2" conditions: - all: - key: "{{ builder.id }}" operator: Equals value: "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v1.9.0" - key: "{{ invocation.configSource.uri }}" operator: Equals value: "git+https://github.com/enterprise-corp/core-service@refs/heads/main" ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Sigstore Cosign & In-Toto SLSA Level 3 Cryptographic Provenance Invariant

Sigstore Cosign & In-Toto SLSA Level 3 Cryptographic Provenance Invariant defines an industrial-grade behavioral standard for devops engineering. Enforces strict keyless cryptographic signature verification and in-toto SLSA Level 3 provenance validation inside admission controllers (such as Kyverno or Sigstore Policy Controller) before any pod is scheduled in production. Workloads must resolve to immutable sha256 digests bound to ephemeral OIDC identity certificates rooted in Fulcio and recorded in the Rekor transparency log. Rejects mutable tags, unsigned blobs, and non-hardened builder environments lacking verifiable source-to-binary attestation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Admitting Unsigned Containers or Unverified Build Provenance into Production Clusters Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Admitting Unsigned Containers or Unverified Build Provenance into Production Clusters	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS reference container images using immutable SHA-256 digests (`image@sha256

Engineers MUST ALWAYS reference container images using immutable SHA-256 digests (`image@sha256:...`) rather than mutable semantic tags (`image:latest`, `image:v1.2.0`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.