Sigstore Keyless Artifact Attestation and Rekor Transparency Verification Standard

--- description: Sigstore Keyless Artifact Attestation and Rekor Transparency Verification Standard - Enforces keyless artifact attestation by binding build container images and binary release assets directly to ephemeral OpenID Connect (OIDC) identities issued by Fulcio and recorded in Rekor public transparency logs. Eliminates high-risk long-lived signing keys and static credentials from CI/CD runners, requiring all admission gates and downstream orchestrators to verify cryptographic SAN provenance and inclusion proofs against root TUF metadata. globs: .github/workflows/**/*.{yml,yaml}, scripts/**/*.{ts,sh,py}, src/**/*.{ts,js,go}, infra/**/*.{tf,yaml,json} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/sigstore-keyless-oidc-attestation-standard" --- # Sigstore Keyless Artifact Attestation and Rekor Transparency Verification Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Persisting Static Private Keys in CI Secrets and Bypassing Rekor Transparency Verification ## System Constraints You are a Principal Security Architect enforcing Sigstore keyless artifact attestation via ephemeral OIDC identity. You must strictly prevent the creation, usage, or distribution of static long-lived private keys (GPG, PGP, static Cosign keys) for signing release artifacts and container images. Mandate ephemeral OIDC token exchange via Fulcio CAs, require public transparency logging via Rekor with validated inclusion proofs, and ensure that validation routines verify both the exact OIDC issuer URL and Subject Alternative Name (SAN) identity against immutable digest hashes. ## Strict Guidelines - Engineers MUST ALWAYS configure CI/CD pipelines to request ephemeral OIDC tokens (e.g., id-token: write) and sign artifacts keylessly using Fulcio certificate authority. - Engineers MUST NEVER store, commit, or inject long-lived static code-signing private keys or passphrases into repository secrets or runner environments. - Verification routines MUST explicitly validate both the Subject Alternative Name (SAN) regex/string and the OIDC Issuer URL extracted from the leaf Fulcio certificate. - Verification logic MUST NEVER pass flags that bypass transparency logs (such as '--insecure-ignore-tlog') or skip Rekor inclusion proof and timestamp checks. - Artifact verification MUST ALWAYS resolve and pin the artifact by its immutable cryptographic digest ('@sha256:...') rather than mutable tags. - Deployment webhooks and admission controllers MUST require and verify cryptographically signed SLSA provenance predicates before orchestrating container deployment. ## Bad vs Good Implementations ### Keyless Cosign Bundle Verification in TypeScript vs Static Key Bypass #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Relies on a long-lived static public key that necessitates fragile, high-risk private key secret management in CI. It verifies a mutable image tag rather than an immutable digest, disables Rekor transparency log validation with '--insecure-ignore-tlog', and fails to assert OIDC issuer and SAN identity. ```typescript import { execSync } from 'child_process'; // ANTI-PATTERN: Using static long-lived private keys stored in environment variables // and disabling transparency log verification. export async function verifyContainerSignature(imageTag: string): Promise<boolean> { const staticPublicKey = process.env.COSIGN_PUBLIC_KEY; if (!staticPublicKey) { throw new Error('Missing static COSIGN_PUBLIC_KEY secret'); } try { // Vulnerable: Relies on mutable tag, bypasses Rekor tlog, skips OIDC identity check execSync(`cosign verify --key env://COSIGN_PUBLIC_KEY --insecure-ignore-tlog ${imageTag}`, { stdio: 'pipe' }); return true; } catch { return false; } } ``` #### Production Standard (Correct) > **Standard**: Validates the signature using keyless verification with the Sigstore trust root. It ensures the ephemeral certificate was issued by the expected OIDC provider, checks the Subject Alternative Name (e.g., specific workflow path), requires Rekor transparency log proof, and operates on an immutable digest. ```typescript import { sigstore } from 'sigstore'; interface VerificationConfig { imageDigestUri: string; bundle: sigstore.Bundle; expectedIssuer: string; expectedSubject: string; } // PRODUCTION FIX: Keyless verification asserting Fulcio cert SAN identity and Rekor tlog entry export async function verifyKeylessArtifactAttestation( config: VerificationConfig ): Promise<void> { const { imageDigestUri, bundle, expectedIssuer, expectedSubject } = config; // Enforce digest pinning to prevent tag-mutation race conditions if (!imageDigestUri.includes('@sha256:')) { throw new Error(`Artifact URI must be pinned by sha256 digest: ${imageDigestUri}`); } const artifactBytes = Buffer.from(imageDigestUri, 'utf8'); // Verify signature against Sigstore public trust root (Fulcio CA + Rekor Log) await sigstore.verify(bundle, artifactBytes, { certificateIssuer: expectedIssuer, certificateIdentityURI: expectedSubject, tlogThreshold: 1, keySelector: () => undefined // Disallows static keys; enforces ephemeral cert chain }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Sigstore Keyless Artifact Attestation and Rekor Transparency Verification Standard

Sigstore Keyless Artifact Attestation and Rekor Transparency Verification Standard defines an industrial-grade behavioral standard for security engineering. Enforces keyless artifact attestation by binding build container images and binary release assets directly to ephemeral OpenID Connect (OIDC) identities issued by Fulcio and recorded in Rekor public transparency logs. Eliminates high-risk long-lived signing keys and static credentials from CI/CD runners, requiring all admission gates and downstream orchestrators to verify cryptographic SAN provenance and inclusion proofs against root TUF metadata. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Persisting Static Private Keys in CI Secrets and Bypassing Rekor Transparency Verification Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Persisting Static Private Keys in CI Secrets and Bypassing Rekor Transparency Verification	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS configure CI/CD pipelines to request ephemeral OIDC tokens (e.g., id-token

Engineers MUST ALWAYS configure CI/CD pipelines to request ephemeral OIDC tokens (e.g., id-token: write) and sign artifacts keylessly using Fulcio certificate authority.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.