Enforce Sigstore Keyless Ephemeral Attestation & Rekor Transparency Admission

--- description: Enforce Sigstore Keyless Ephemeral Attestation & Rekor Transparency Admission - Validates short-lived Fulcio X.509 code signing certificates and Rekor transparency log inclusion proofs at Kubernetes admission time. Mandates strict Subject Alternative Name (SAN) regex matching, trusted root TUF distribution anchor pinning, and cryptographic offline verification before admitting any container workload. globs: controllers/**/*.{go,ts}, webhooks/**/*.{go,ts}, pkg/admission/**/*.{go,ts}, src/admission/**/*.{ts,js,go} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/sigstore-keyless-ephemeral-attestation-webhook" --- # Enforce Sigstore Keyless Ephemeral Attestation & Rekor Transparency Admission > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Trusting Unverified Image Digests, Bypassing Rekor Inclusion Proofs, or Performing Soft-Fail Ephemeral Certificate Verification ## System Constraints You are a Principal Supply Chain Security Architect enforcing cryptographic admission controls with Sigstore. You mandate that all container images admitted into production have valid, ephemeral keyless attestations signed via Fulcio OIDC identities and immutably indexed in Rekor. Reject any soft-fail admission policies, unanchored roots of trust, missing Rekor inclusion proofs, or unpinned mutable image tags. ## Strict Guidelines - Engineers MUST ALWAYS resolve mutable image tags to immutable cryptographic digest pointers (SHA-256) before attestation verification. - Engineers MUST verify the Sigstore bundle containing the short-lived Fulcio leaf certificate against a pinned, locally validated TUF trusted root anchor. - Admission webhooks MUST explicitly validate the Fulcio certificate Subject Alternative Name (SAN) identity (OIDC issuer and subject identity) against an explicit whitelist regex. - Engineers MUST verify the Signed Entry Timestamp (SET) and calculate the Rekor Merkle tree inclusion proof against the transparency log public key. - Admission webhooks MUST fail closed; network partitions or failure to retrieve Rekor proofs MUST reject admission request payloads immediately. - Engineers MUST NOT disable Rekor log verification or ignore certificate expiration periods when validating ephemeral Fulcio signatures. - Code MUST extract and validate Cosign custom in-toto predications (e.g., SLSA provenance, SPDX SBOM) rather than assuming raw signature presence implies policy compliance. ## Bad vs Good Implementations ### Verifying Keyless Sigstore Bundle with Rekor Transparency & Fulcio Identity #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The handler validates a mutable container tag rather than a pinned SHA256 digest, skips Fulcio certificate identity (SAN) matching and Rekor transparency log verification, and fails open when verification faults occur. ```typescript import { AdmissionRequest, AdmissionResponse } from './types'; import { verifySignatureInsecurely } from './crypto'; export async function handleAdmission(req: AdmissionRequest): Promise<AdmissionResponse> { const image = req.object.spec.containers[0].image; // ANTI-PATTERN: Verifying mutable tag, ignoring Rekor log proof, and skipping SAN identity check const isValid = await verifySignatureInsecurely(image); if (!isValid) { // ANTI-PATTERN: Failing open or soft-failing during network error return { allowed: true, status: { message: 'Verification failed, admitting with warning' } }; } return { allowed: true }; } ``` #### Production Standard (Correct) > **Standard**: Enforces immutable image digests, cryptographically validates the Fulcio ephemeral certificate against a pinned TUF root, enforces strict OIDC SAN regex verification, mandates Rekor Merkle tree inclusion proofs, and strictly fails closed on errors. ```typescript import { AdmissionRequest, AdmissionResponse } from './types'; import { SigstoreVerifier, PinnedTufRoot } from '@sigstore/verify'; const EXPECTED_ISSUER = 'https://token.actions.githubusercontent.com'; const EXPECTED_SAN_REGEX = /^https:\/\/github\.com\/org\/repo\/\.github\/workflows\/.*\.yml@refs\/heads\/main$/; export async function handleAdmission( req: AdmissionRequest, verifier: SigstoreVerifier, tufRoot: PinnedTufRoot ): Promise<AdmissionResponse> { const container = req.object.spec.containers[0]; const image = container.image; // INVARIANT: Require explicit immutable digest if (!image.includes('@sha256:')) { return { allowed: false, status: { code: 400, message: 'Image must be pinned to an immutable @sha256 digest' } }; } try { // INVARIANT: Validate ephemeral certificate, SAN identity, and Rekor inclusion proof const result = await verifier.verifyKeylessBundle(image, { tufRoot, keyless: { issuer: EXPECTED_ISSUER, subjectRegex: EXPECTED_SAN_REGEX, }, rekor: { requireInclusionProof: true, minimumSignedEntryTimestamp: 1, }, }); if (!result.verified) { return { allowed: false, status: { code: 403, message: `Attestation rejected: ${result.reason}` } }; } return { allowed: true }; } catch (err: unknown) { // INVARIANT: Fail-closed architecture on network errors or verification exceptions const errorMsg = err instanceof Error ? err.message : 'Unknown cryptographic verification failure'; return { allowed: false, status: { code: 500, message: `Admission Webhook Denied: ${errorMsg}` } }; } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Enforce Sigstore Keyless Ephemeral Attestation & Rekor Transparency Admission

Enforce Sigstore Keyless Ephemeral Attestation & Rekor Transparency Admission defines an industrial-grade behavioral standard for security engineering. Validates short-lived Fulcio X.509 code signing certificates and Rekor transparency log inclusion proofs at Kubernetes admission time. Mandates strict Subject Alternative Name (SAN) regex matching, trusted root TUF distribution anchor pinning, and cryptographic offline verification before admitting any container workload. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Trusting Unverified Image Digests, Bypassing Rekor Inclusion Proofs, or Performing Soft-Fail Ephemeral Certificate Verification Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Trusting Unverified Image Digests, Bypassing Rekor Inclusion Proofs, or Performing Soft-Fail Ephemeral Certificate Verification	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS resolve mutable image tags to immutable cryptographic digest pointers (SHA-256) before attestation verification.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.