AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
securitycritical PriorityID: sigstore-cosign-slsa3-ephemeral-keyless-guardrail

Sigstore Cosign SLSA Level 3 Ephemeral Keyless Attestation & Admission Guardrail

Enforces cryptographically verifiable provenance and container integrity via Sigstore Cosign utilizing ephemeral OIDC workload identities (Fulcio, Rekor). Mandates cluster-wide Kubernetes admission control (Kyverno/Policy Controller) to reject any container image lacking verifiable SLSA Level 3 provenance attestations and signed SBOMs prior to pod execution.

Prohibited Anti-Pattern: Deploying unsigned container images or relying on static long-lived signing keys without admission verification

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Sigstore Cosign SLSA Level 3 Ephemeral Keyless Attestation & Admission Guardrail - Enforces cryptographically verifiable provenance and container integrity via Sigstore Cosign utilizing ephemeral OIDC workload identities (Fulcio, Rekor). Mandates cluster-wide Kubernetes admission control (Kyverno/Policy Controller) to reject any container image lacking verifiable SLSA Level 3 provenance attestations and signed SBOMs prior to pod execution.
globs: .github/workflows/**/*.{yml,yaml}, kustomize/**/*.{yml,yaml}, helm/**/*.{yml,yaml}, deploy/**/*.{yml,yaml}, policies/**/*.{yml,yaml}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/sigstore-cosign-slsa3-ephemeral-keyless-guardrail"
---

# Sigstore Cosign SLSA Level 3 Ephemeral Keyless Attestation & Admission Guardrail

> **Severity**: CRITICAL | **Category**: security
> **Anti-Pattern Warning**: Deploying unsigned container images or relying on static long-lived signing keys without admission verification

## System Constraints
You are a Principal Security Architect enforcing Sigstore Cosign SLSA Level 3 ephemeral keyless signing and Kubernetes admission verification. You must prohibit hardcoded private keys, non-OIDC signing flows, unverified image digests, and missing provenance attestations. Enforce strict keyless Fulcio/Rekor binding, immutability by digest, and Kyverno/Sigstore Policy Controller admission policies on all workloads.

## Strict Guidelines
- Engineers MUST ALWAYS sign OCI images using Sigstore Cosign keyless mode backed by short-lived OIDC workload identities (Fulcio CA) and transparency log integration (Rekor).
- Engineers MUST NOT generate, store, or reference long-lived static private signing keys (e.g., cosign.key) or API secrets inside CI/CD pipelines.
- CI/CD pipelines MUST attest SLSA Level 3 build provenance and attach CycloneDX/SPDX SBOMs directly to the container digest before artifact promotion.
- Kubernetes admission controllers MUST enforce strict ImageValidatingPolicies or ClusterPolicies that reject any image not referenced by an immutable SHA256 digest with verified Rekor-backed provenance.
- Workload specifications MUST NEVER reference mutable image tags (e.g., ':latest', ':v1.0') in production manifests; exact immutable digests (e.g., 'image@sha256:...') are required.

## Bad vs Good Implementations
### CI/CD Pipeline: Static Key Signing vs. Ephemeral OIDC Keyless Attestation

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Relies on a compromised long-lived private key, uses a mutable tag susceptible to race conditions and poisoning, and fails to emit cryptographic SLSA provenance or record into the Rekor transparency log.
```yaml
# Anti-Pattern: Using static secrets, mutable tags, and skipping provenance
name: Build & Push Unsafe
on: [push]
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: docker build -t ghcr.io/org/api:latest .
      - run: docker push ghcr.io/org/api:latest
      - env:
          COSIGN_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
        run: cosign sign --key env://COSIGN_KEY ghcr.io/org/api:latest
```

#### Production Standard (Correct)
> **Standard**: Eliminates static key leakage using GitHub Actions OIDC id-token permissions, signs strictly via immutable digest, logs to Rekor transparency log, and generates verified SLSA provenance.
```yaml
# Standard: Ephemeral OIDC keyless signing with Rekor logging and SLSA attestation
name: Build, Sign & Attest SLSA 3
on:
  push:
    branches: [main]
permissions:
  id-token: write
  contents: read
  packages: write
jobs:
  build-and-attest:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: sigstore/[email protected]
      - id: build
        run: |
          docker buildx build --push -t ghcr.io/org/api:${{ github.sha }} .
          DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' ghcr.io/org/api:${{ github.sha }})
          echo "digest=${DIGEST}" >> $GITHUB_OUTPUT
      - name: Sign Container Digest Keyless
        run: |
          cosign sign --yes \
            --oidc-provider=github-actions \
            ${{ steps.build.outputs.digest }}
      - name: Attest SLSA Provenance
        run: |
          cosign attest --yes \
            --type slsaprovenance \
            --predicate slsa-predicate.json \
            ${{ steps.build.outputs.digest }}
```

### Kubernetes Admission: Unchecked Deployment vs. Strict Kyverno Keyless Attestation Policy

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Deploys an unverified container referencing a mutable tag with zero cryptographic verification of origin, identity, or build provenance.
```yaml
# Anti-Pattern: Allowing unverified images into production cluster
apiVersion: apps/v1
kind: Deployment
metadata:
  name: payment-service
spec:
  template:
    spec:
      containers:
        - name: payment-api
          image: ghcr.io/org/payment-service:latest
```

#### Production Standard (Correct)
> **Standard**: Enforces admission-time validation via Kyverno: blocks untrusted images, asserts OIDC subject matches the authoritative CI repo workflow, and guarantees SLSA v0.2 provenance verified against Rekor.
```yaml
# Standard: Kyverno ClusterPolicy validating keyless OIDC identity and SLSA attestation
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: enforce-keyless-slsa-attestation
spec:
  validationFailureAction: Enforce
  webhookTimeoutSeconds: 30
  rules:
    - name: verify-image-sigstore-keyless
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - "ghcr.io/org/*"
          attestors:
            - entries:
                - keyless:
                    subject: "https://github.com/org/*/.github/workflows/*@refs/heads/main"
                    issuer: "https://token.actions.githubusercontent.com"
                    rekor:
                      url: "https://rekor.sigstore.dev"
          attestations:
            - predicateType: "https://slsa.dev/provenance/v0.2"
              conditions:
                - all:
                    - key: "{{ builder.id }}"
                      operator: Equals
                      value: "https://github.com/org/.github/workflows/*"
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

GitHub Actions MCP Server
Inspects and audits CI/CD workflow security settings, OIDC identity claims, and permission boundaries.
Kubernetes MCP Server
Evaluates running cluster state, deployed workload digests, and admission policy enforcement objects.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Sigstore Cosign CLI Skill
Validates container signatures, parses Fulcio x509 extensions, and verifies Rekor entry inclusion proofs from the command line.
Kyverno Policy CLI Engine
Tests and statically evaluates admission policies against Kubernetes manifests and image digests before deployment.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Sigstore Cosign SLSA Level 3 Ephemeral Keyless Attestation & Admission Guardrail

Sigstore Cosign SLSA Level 3 Ephemeral Keyless Attestation & Admission Guardrail defines an industrial-grade behavioral standard for security engineering. Enforces cryptographically verifiable provenance and container integrity via Sigstore Cosign utilizing ephemeral OIDC workload identities (Fulcio, Rekor). Mandates cluster-wide Kubernetes admission control (Kyverno/Policy Controller) to reject any container image lacking verifiable SLSA Level 3 provenance attestations and signed SBOMs prior to pod execution. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Deploying unsigned container images or relying on static long-lived signing keys without admission verification Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftDeploying unsigned container images or relying on static long-lived signing keys without admission verificationCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS sign OCI images using Sigstore Cosign keyless mode backed by short-lived OIDC workload identities (Fulcio CA) and transparency log integration (Rekor).

Engineers MUST ALWAYS sign OCI images using Sigstore Cosign keyless mode backed by short-lived OIDC workload identities (Fulcio CA) and transparency log integration (Rekor).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST NOT generate, store, or reference long-lived static private signing keys (e.g., cosign.key) or API secrets inside CI/CD pipelines.

Engineers MUST NOT generate, store, or reference long-lived static private signing keys (e.g., cosign.key) or API secrets inside CI/CD pipelines.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

CI/CD pipelines MUST attest SLSA Level 3 build provenance and attach CycloneDX/SPDX SBOMs directly to the container digest before artifact promotion.

CI/CD pipelines MUST attest SLSA Level 3 build provenance and attach CycloneDX/SPDX SBOMs directly to the container digest before artifact promotion.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Kubernetes admission controllers MUST enforce strict ImageValidatingPolicies or ClusterPolicies that reject any image not referenced by an immutable SHA256 digest with verified Rekor-backed provenance.

Kubernetes admission controllers MUST enforce strict ImageValidatingPolicies or ClusterPolicies that reject any image not referenced by an immutable SHA256 digest with verified Rekor-backed provenance.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Workload specifications MUST NEVER reference mutable image tags (e.g., '

Workload specifications MUST NEVER reference mutable image tags (e.g., ':latest', ':v1.0') in production manifests; exact immutable digests (e.g., 'image@sha256:...') are required.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Sigstore Cosign SLSA Level 3 Ephemeral Keyless Attestation & Admission Guardrail critical for AI coding assistants?

Enforces cryptographically verifiable provenance and container integrity via Sigstore Cosign utilizing ephemeral OIDC workload identities (Fulcio, Rekor). Mandates cluster-wide Kubernetes admission control (Kyverno/Policy Controller) to reject any container image lacking verifiable SLSA Level 3 provenance attestations and signed SBOMs prior to pod execution. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Deploying unsigned container images or relying on static long-lived signing keys without admission verification) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related SECURITY Rules

View all rules →
security
105

OpenFGA Graph Invariants: Cyclic Relation Prevention & Contextual Tuple Hardening

Enforces strict directed acyclic graph (DAG) topology validation during relationship mutation writes and mandates strict server-side schema verification for ephemeral contextual tuples in OpenFGA evaluations. Prohibits persistent storage of ephemeral request attributes and guards against recursive relation loops causing graph expansion denial-of-service.

security
81

WebAuthn Conditional UI Mediation, Nonce Atomicity, and Assertion Cryptographic Verification

Enforces zero-trust cryptographic validation for FIDO2/WebAuthn Passkey authentication with Conditional UI autofill. Requires atomic single-use challenge consumption to eliminate replay attacks, strict RP ID hash and origin binding, authenticatorData flag verification (User Presence and User Verification), and monotonic signature counter enforcement to detect authenticator cloning.

security
111

Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification

Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution.

1 Rule in Stack

Sigstore