Sigstore Ephemeral OIDC Keyless Attestation & SLSA v1.0 Invariant Verification

--- description: Sigstore Ephemeral OIDC Keyless Attestation & SLSA v1.0 Invariant Verification - Enforces zero-static-secret supply chain security by mandating ephemeral OpenID Connect (OIDC) identity tokens for artifact signing via Fulcio and Rekor transparency logging. Prohibits persistent cryptographic signing keys in CI/CD environments and enforces SLSA v1.0 in-toto provenance attestation verification before deployment. globs: .github/workflows/**/*.{yml,yaml}, infra/**/*.{ts,tsx}, src/security/**/*.{ts,tsx}, scripts/**/*.{ts,js,sh} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/sigstore-ephemeral-oidc-slsa-attestation" --- # Sigstore Ephemeral OIDC Keyless Attestation & SLSA v1.0 Invariant Verification > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Signing artifacts with long-lived static private keys in CI/CD without Rekor transparency or SLSA provenance ## System Constraints You are a Principal Software Architect enforcing Sigstore ephemeral OIDC keyless signing and SLSA v1.0 provenance invariants. You strictly prohibit long-lived private keys, static signing credentials (like PGP or raw PEM secrets), and unverified artifact deployments. Every deployment artifact must be cryptographically verified using ambient OIDC identities against Sigstore's Fulcio CA, confirmed in the Rekor transparency log, and validated against SLSA v1.0 provenance predicates. ## Strict Guidelines - Engineers MUST ALWAYS use ambient CI/CD OIDC tokens (e.g., GitHub Actions id-token: write) to acquire short-lived X.509 certificates from Fulcio. - Engineers MUST NOT persist private keys or import long-lived signing keys (COSIGN_KEY, GPG_KEY, PEM) into CI/CD secrets. - Deployment verifiers MUST ALWAYS validate the Subject Alternative Name (SAN) URI and Issuer in the Fulcio certificate against immutable build environment identities. - Verification pipelines MUST ALWAYS confirm the inclusion proof in the Rekor transparency log to prevent split-view attacks. - Artifact deployment gates MUST validate SLSA v1.0 in-toto provenance predicates (builder ID, source repo, commit SHA) prior to container initialization. - Code NEVER trusts unauthenticated local container images or dependencies without matching Rekor-logged bundle verification. ## Bad vs Good Implementations ### Artifact Verification with Sigstore Ephemeral OIDC and Rekor Invariants #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Relies on a static public/private keypair managed via long-lived secrets, missing ambient OIDC identity verification, Fulcio certificate validation, and Rekor inclusion checks. Does not enforce SLSA v1.0 provenance. ```typescript import { execSync } from 'node:child_process'; interface DeploymentPayload { imageDigest: string; } // ANTI-PATTERN: Verifies signature using a hardcoded or env-supplied static public key. // Lacks Rekor transparency validation and SLSA v1.0 provenance assertion. export async function verifyAndDeploy(payload: DeploymentPayload): Promise<void> { const staticPublicKey = process.env.STATIC_COSIGN_PUBLIC_KEY; if (!staticPublicKey) { throw new Error('Missing static signing key'); } // Relies on static secrets prone to rotation failures and leakage execSync(`cosign verify --key env://STATIC_COSIGN_PUBLIC_KEY ${payload.imageDigest}`); // Deploying without validating build source or SLSA provenance console.log(`Deploying image: ${payload.imageDigest}`); } ``` #### Production Standard (Correct) > **Standard**: Implements keyless verification utilizing Sigstore. It verifies Fulcio-issued ephemeral X.509 certs against specific OIDC SAN identities, enforces Rekor transparency log proof thresholds, and confirms SLSA v1.0 predicate conformance without static secrets. ```typescript import { verifyBundle, type SerializedBundle } from '@sigstore/verify'; interface VerifiedArtifact { artifactDigest: string; bundle: SerializedBundle; expectedRepo: string; expectedWorkflow: string; } const FULCIO_ISSUER = 'https://token.actions.githubusercontent.com'; const EXPECTED_SLSA_PREDICATE = 'https://slsa.dev/provenance/v1'; // PRODUCTION INVARIANT: Keyless OIDC verification with Fulcio SAN validation and Rekor transparency check export async function verifyKeylessAttestation(artifact: VerifiedArtifact): Promise<boolean> { const artifactBuffer = Buffer.from(artifact.artifactDigest, 'hex'); // Verify ephemeral certificate from Fulcio logged in Rekor transparency log const result = await verifyBundle(artifact.bundle, artifactBuffer, { certificateIssuer: FULCIO_ISSUER, certificateIdentityURI: `https://github.com/${artifact.expectedRepo}/${artifact.expectedWorkflow}`, keyless: true, ctlogThreshold: 1, tlogThreshold: 1 }); if (!result) { throw new Error('Sigstore keyless verification failed: Missing valid Rekor proof or Fulcio certificate.'); } // Verify in-toto SLSA v1.0 Predicate const dsseEnvelope = artifact.bundle.dsseEnvelope; if (dsseEnvelope && dsseEnvelope.payloadType === 'application/vnd.in-toto+json') { const payload = JSON.parse(Buffer.from(dsseEnvelope.payload, 'base64').toString('utf8')); if (payload.predicateType !== EXPECTED_SLSA_PREDICATE) { throw new Error(`Invalid SLSA predicate: expected ${EXPECTED_SLSA_PREDICATE}, received ${payload.predicateType}`); } } return true; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Sigstore Ephemeral OIDC Keyless Attestation & SLSA v1.0 Invariant Verification

Sigstore Ephemeral OIDC Keyless Attestation & SLSA v1.0 Invariant Verification defines an industrial-grade behavioral standard for security engineering. Enforces zero-static-secret supply chain security by mandating ephemeral OpenID Connect (OIDC) identity tokens for artifact signing via Fulcio and Rekor transparency logging. Prohibits persistent cryptographic signing keys in CI/CD environments and enforces SLSA v1.0 in-toto provenance attestation verification before deployment. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Signing artifacts with long-lived static private keys in CI/CD without Rekor transparency or SLSA provenance Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Signing artifacts with long-lived static private keys in CI/CD without Rekor transparency or SLSA provenance	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS use ambient CI/CD OIDC tokens (e.g., GitHub Actions id-token

Engineers MUST ALWAYS use ambient CI/CD OIDC tokens (e.g., GitHub Actions id-token: write) to acquire short-lived X.509 certificates from Fulcio.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.