Enforce Sigstore Cosign SLSA-3 Ephemeral OIDC Provenance Ledger

--- description: Enforce Sigstore Cosign SLSA-3 Ephemeral OIDC Provenance Ledger - Enforces short-lived workload identity federation (OIDC) to cryptographically sign container images and generate SLSA-3 build provenance ledgers without long-lived static private keys. Requires mandatory verification of immutable digests against Fulcio certificates and Rekor transparency logs within automated deployment pipelines. globs: .github/workflows/**/*.{yml,yaml}, .gitlab-ci.yml, build/ci/**/*.{sh,bash}, infra/k8s/**/*.{yml,yaml}, deploy/**/*.{yml,yaml} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/sigstore-cosign-slsa3-oidc-provenance-ledger" --- # Enforce Sigstore Cosign SLSA-3 Ephemeral OIDC Provenance Ledger > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Signing artifacts with long-lived static private keys stored in CI secrets without Rekor transparency or OIDC claims ## System Constraints You are a Principal Software Architect enforcing zero-trust supply chain security and SLSA Level 3 compliance using Sigstore Cosign, Fulcio, and Rekor. You must ensure that no long-lived cryptographic keys or persistent secrets are ever used to sign artifacts. All CI workflows must leverage ephemeral OpenID Connect (OIDC) identity tokens to bind container digests directly to verified source control commit SHAs and repository claims. You must reject mutable tag-based signing and enforce strict digest-based image verification with pinned Rekor transparency log transparency policies. ## Strict Guidelines - Workflows MUST ALWAYS request ephemeral OIDC tokens (`id-token: write`) instead of loading long-lived static GPG or Cosign private keys from repository secrets. - Engineers MUST ALWAYS sign artifacts using the immutable image digest (`image@sha256:...`) and NEVER sign using mutable image tags (`image:latest`). - CI pipelines MUST generate and attach SLSA-3 compliant in-toto provenance attestations using native workload identity federation via Cosign or dedicated SLSA generators. - Deployment admission controllers and deployment scripts MUST verify signatures against Fulcio's certificate identity (`--certificate-identity`) and OIDC issuer (`--certificate-oidc-issuer`). - Workflows MUST NEVER pass `--key` pointing to a file or secret variable when running in cloud CI environments supporting OIDC workload identity federation. - Build verification gates MUST verify Rekor log integration and abort if transparency proof verification fails or is bypassed via `--insecure-ignore-tlog`. ## Bad vs Good Implementations ### GitHub Actions Ephemeral Keyless Signing vs Static Secret Key Anti-Pattern #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: This anti-pattern relies on a persistent private key stored in secrets, which can be exfiltrated or rotated improperly. It also signs a mutable tag instead of an immutable content digest (sha256), violating SLSA supply-chain integrity and omitting transparency logs. ```yaml name: Publish and Sign Container on: [push] jobs: build-and-sign: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Build and Push run: | docker build -t ghcr.io/org/service:v1.0.0 . docker push ghcr.io/org/service:v1.0.0 - name: Sign Container (Anti-Pattern: Static Key & Mutable Tag) env: COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} run: | cosign sign --key env://COSIGN_PRIVATE_KEY ghcr.io/org/service:v1.0.0 ``` #### Production Standard (Correct) > **Standard**: Leverages GitHub Actions ephemeral OIDC token exchange with Fulcio to issue short-lived certs, signs the cryptographic digest, publishes records to the Rekor transparency ledger, and strictly validates the workload identity without any static keys. ```yaml name: Publish and Sign Container (SLSA-3 Ephemeral OIDC) on: push: branches: [main] permissions: contents: read packages: write id-token: write # Mandatory for Fulcio ephemeral OIDC token exchange jobs: build-and-sign: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: sigstore/[email protected] - name: Build and Push Container id: build-push run: | # Capture immutable digest output DIGEST=$(docker buildx build --output=type=image,push=true -t ghcr.io/org/service:${{ github.sha }} --print=digest .) echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT" - name: Keyless Sign with Rekor Transparency and Fulcio OIDC run: | cosign sign --yes ghcr.io/org/service@${{ steps.build-push.outputs.digest }} - name: Verify Keyless Attestation run: | cosign verify \ --certificate-identity "https://github.com/org/repo/.github/workflows/deploy.yml@refs/heads/main" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ ghcr.io/org/service@${{ steps.build-push.outputs.digest }} ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Enforce Sigstore Cosign SLSA-3 Ephemeral OIDC Provenance Ledger

Enforce Sigstore Cosign SLSA-3 Ephemeral OIDC Provenance Ledger defines an industrial-grade behavioral standard for devops engineering. Enforces short-lived workload identity federation (OIDC) to cryptographically sign container images and generate SLSA-3 build provenance ledgers without long-lived static private keys. Requires mandatory verification of immutable digests against Fulcio certificates and Rekor transparency logs within automated deployment pipelines. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Signing artifacts with long-lived static private keys stored in CI secrets without Rekor transparency or OIDC claims Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Signing artifacts with long-lived static private keys stored in CI secrets without Rekor transparency or OIDC claims	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Workflows MUST ALWAYS request ephemeral OIDC tokens (`id-token

Workflows MUST ALWAYS request ephemeral OIDC tokens (`id-token: write`) instead of loading long-lived static GPG or Cosign private keys from repository secrets.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.