Sigstore Ephemeral OIDC Fulcio-Rekor Supply Chain Attestation Verification

--- description: Sigstore Ephemeral OIDC Fulcio-Rekor Supply Chain Attestation Verification - Enforces non-repudiable cryptographic build provenance and keyless container verification using Sigstore's Fulcio CA and Rekor transparency log. Rejects all static long-lived private signing keys and mandates strict verification of OIDC identity issuer claims, Rekor bundle inclusion, and SLSA provenance at admission time before deployment. globs: .github/workflows/**/*.{yml,yaml}, deploy/**/*.{yml,yaml}, k8s/**/*.{yml,yaml}, policies/**/*.{yml,yaml}, src/**/*.{ts,js,go,py} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/sigstore-ephemeral-oidc-attestation-standard" --- # Sigstore Ephemeral OIDC Fulcio-Rekor Supply Chain Attestation Verification > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Deploying container images signed with long-lived static private keys or verifying Cosign signatures without strict OIDC issuer and Rekor transparency constraints ## System Constraints You are a Principal Security Architect enforcing the Sigstore Ephemeral OIDC Fulcio-Rekor Supply Chain Attestation Standard. Mandate keyless signing via ambient OIDC credentials (Fulcio) recorded on the Rekor transparency log. Reject static long-lived cryptographic keys (such as cosign.key), unpinned container image digests, and missing OIDC issuer/identity verification in admission controllers (Kyverno, Ratify, or Sigstore Policy Controller). Ensure cryptographic non-repudiation across the entire software supply chain. ## Strict Guidelines - Engineers MUST ALWAYS sign container artifacts keylessly using ambient OIDC identity tokens backed by Fulcio and verified against the Rekor transparency log. - Engineers MUST NEVER provision, check in, or mount static private signing keys (e.g., COSIGN_KEY, GPG keys) in CI/CD pipelines or cluster secrets. - Admission control policies MUST verify the exact OIDC issuer (`certificate-oidc-issuer`) and SAN identity (`certificate-identity` or `certificate-identity-regexp`) matching the trusted repository and ref. - Deployments MUST pin container images by immutable SHA256 digest alongside human-readable tags to prevent TOCTOU race conditions and bypass of verification. - Verification routines MUST assert Rekor transparency log entry inclusion (`tlog-upload: true`) and reject offline validations that bypass timestamp and revocation transparency. - CI/CD workflows MUST request `id-token: write` permissions with the minimal possible ambient scope to generate ephemeral Fulcio X.509 certificates. ## Bad vs Good Implementations ### GitHub Actions Keyless OIDC Signing vs Static Private Key Anti-Pattern #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using long-lived static private keys introduces key management debt, risk of secret exfiltration, non-rotated compromise vectors, and lacks immutable association with the CI job's verifiable ambient OIDC identity. ```yaml name: Build and Sign on: push jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: docker build -t myrepo/app:latest . # VULNERABLE: Uses long-lived static private key secret - uses: sigstore/[email protected] - run: cosign sign --key env://COSIGN_PRIVATE_KEY myrepo/app:latest env: COSIGN_PRIVATE_KEY: ${{ secrets.STATIC_COSIGN_KEY }} COSIGN_PASSWORD: ${{ secrets.STATIC_COSIGN_PWD }} ``` #### Production Standard (Correct) > **Standard**: Employs ephemeral Fulcio X.509 certificates obtained via GitHub Actions ambient OIDC federation (`id-token: write`). The signature is registered directly to Rekor with no static secrets to rotate or leak. ```yaml name: Build and Keyless Sign on: push permissions: contents: read packages: write id-token: write # Required for ambient OIDC token to Fulcio jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: sigstore/[email protected] - run: | docker build -t ghcr.io/${{ github.repository }}@sha256:... . # Keyless signing via ambient OIDC token + Rekor publication cosign sign --yes ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }} ``` ### Cluster Admission Verification: Kyverno Keyless Fulcio-Rekor ClusterPolicy #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Validating solely against a static public key fails to enforce transparency log verification (Rekor), does not bind signatures to specific automated workflows, and creates risk if the private key was stolen. ```yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: verify-image spec: validationFailureAction: Enforce rules: - name: verify-signature match: resources: kinds: ['Pod'] verifyImages: - imageReferences: ['ghcr.io/myorg/*'] # INSECURE: Verifies only public key without checking provenance or transparency key: |- -----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE... -----END PUBLIC KEY----- ``` #### Production Standard (Correct) > **Standard**: Enforces admission-time keyless verification against Sigstore's Fulcio root and Rekor log. Cryptographically matches the exact OIDC issuer and repository workflow path. ```yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: verify-keyless-image spec: validationFailureAction: Enforce webhookTimeoutSeconds: 30 rules: - name: verify-fulcio-rekor match: resources: kinds: ['Pod'] verifyImages: - imageReferences: ['ghcr.io/myorg/*'] attestors: - entries: - keyless: subject: 'https://github.com/myorg/myapp/.github/workflows/deploy.yml@refs/heads/main' issuer: 'https://token.actions.githubusercontent.com' rekor: url: 'https://rekor.sigstore.dev' required: true ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Sigstore Ephemeral OIDC Fulcio-Rekor Supply Chain Attestation Verification

Sigstore Ephemeral OIDC Fulcio-Rekor Supply Chain Attestation Verification defines an industrial-grade behavioral standard for devops engineering. Enforces non-repudiable cryptographic build provenance and keyless container verification using Sigstore's Fulcio CA and Rekor transparency log. Rejects all static long-lived private signing keys and mandates strict verification of OIDC identity issuer claims, Rekor bundle inclusion, and SLSA provenance at admission time before deployment. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Deploying container images signed with long-lived static private keys or verifying Cosign signatures without strict OIDC issuer and Rekor transparency constraints Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Deploying container images signed with long-lived static private keys or verifying Cosign signatures without strict OIDC issuer and Rekor transparency constraints	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS sign container artifacts keylessly using ambient OIDC identity tokens backed by Fulcio and verified against the Rekor transparency log.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.