Mandatory Sigstore Keyless OIDC Attestation & SLSA v1.0 Provenance Verification

--- description: Mandatory Sigstore Keyless OIDC Attestation & SLSA v1.0 Provenance Verification - Enforces strict admission-time cryptographic verification of container images using Sigstore keyless signatures and SLSA provenance attestations. Rejects long-lived static keys in favor of ephemeral Fulcio X.509 certificates verified against Rekor transparency logs with pinned OIDC issuer and subject SANs. globs: admission/**/*.{ts,js}, policies/**/*.{rego,yaml}, src/security/**/*.{ts,js}, src/admission/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/sigstore-keyless-slsa-attestation-admission-guardrail" --- # Mandatory Sigstore Keyless OIDC Attestation & SLSA v1.0 Provenance Verification > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Admitting Images via Unscoped Static Keys or Bypassing Rekor Inclusion Proofs and Predicate Validation ## System Constraints You are a Principal Security Architect enforcing zero-trust software supply chain guardrails. You must mandate automated admission-controller verification of container images using Sigstore keyless OIDC attestations and SLSA Provenance predicates. Prevent the deployment of any artifact lacking cryptographically validated Rekor transparency log proofs, trusted Fulcio root certificates, and strict regex-matched OIDC identity claims (SANs). ## Strict Guidelines - Engineers MUST ALWAYS resolve mutable image tags to immutable cryptographic sha256 digests before initiating any attestation verification. - Engineers MUST ALWAYS enforce keyless OIDC identity validation, explicitly checking both the expected issuer (e.g., https://token.actions.githubusercontent.com) and the exact subject SAN (e.g., repository workflow ref). - Engineers MUST verify Rekor transparency log inclusion proofs (Signed Entry Timestamps / SETs) and Fulcio certificate validity at the time of signing. - Engineers MUST NOT accept static public keys (e.g., cosign.pub) or self-signed certificates for production container admission. - Code SHOULD inspect the deserialized SLSA v1.0 / in-toto predicate payload to ensure the buildDefinition.source matches approved repositories and commit SHAs. - Services MUST fail closed on webhook timeouts, verification errors, or missing Rekor transparency log bundle proofs. ## Bad vs Good Implementations ### Sigstore Keyless Verification and SLSA Attestation Admission Check #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Relies on a static public key prone to compromise, omits mutable tag resolution to immutable digests, ignores Fulcio ephemeral certificate validation, fails to verify Rekor transparency log inclusion proofs, and never inspects the SLSA provenance predicate. ```typescript import { Request, Response } from 'express'; // ANTI-PATTERN: Verifying with static public key, skipping Rekor log checks, // and not validating OIDC claims or SLSA predicate contents. export async function validateImageAdmission(req: Request, res: Response) { const { imageUri, signature } = req.body; // Insecure: Using static public key from environment variable const isSignatureValid = verifyStaticKey(imageUri, signature, process.env.COSIGN_PUB_KEY!); if (!isSignatureValid) { return res.status(403).json({ allowed: false, message: 'Invalid signature' }); } // Insecure: Image tag is mutable, no transparency log check, no identity check return res.status(200).json({ allowed: true }); } function verifyStaticKey(img: string, sig: string, pubKey: string): boolean { return Boolean(img && sig && pubKey); } ``` #### Production Standard (Correct) > **Standard**: Enforces immutable image digests, cryptographically validates the Sigstore bundle against Rekor and Fulcio, validates the OIDC issuer and SAN identity against strict patterns, checks the SLSA v1.0 predicate type, and fails closed on validation failure. ```typescript import { Request, Response } from 'express'; import { verifyBundle, type VerificationOptions } from '@sigstore/verify'; interface AdmissionRequest { image: string; digest: string; bundle: Record<string, unknown>; } const TRUSTED_ISSUER = 'https://token.actions.githubusercontent.com'; const TRUSTED_SAN_REGEX = /^https:\/\/github\.com\/org-repo\/\.github\/workflows\/deploy\.yml@refs\/heads\/main$/; const EXPECTED_BUILD_TYPE = 'https://slsa.dev/provenance/v1'; export async function validateImageAdmission(req: Request, res: Response) { const { image, digest, bundle } = req.body as AdmissionRequest; // 1. Mandatory immutable digest enforcement if (!digest || !digest.startsWith('sha256:') || !image.includes(digest)) { return res.status(400).json({ allowed: false, message: 'Image must be addressed by immutable SHA256 digest' }); } const options: VerificationOptions = { // 2. Strict OIDC Subject Alternative Name and Issuer validation certificateIssuer: TRUSTED_ISSUER, certificateIdentityURI: TRUSTED_SAN_REGEX, // 3. Enforce transparency log (Rekor) verification via root of trust tlogIntegratedAt: true }; try { // 4. Cryptographic verification of Fulcio cert, Rekor inclusion, and signature const result = await verifyBundle(bundle, Buffer.from(digest), options); // 5. Inspect in-toto / SLSA predicate assertions const payload = JSON.parse(result.payload.toString('utf-8')); if (payload.predicateType !== EXPECTED_BUILD_TYPE) { return res.status(403).json({ allowed: false, message: `Untrusted predicate: ${payload.predicateType}` }); } return res.status(200).json({ allowed: true }); } catch (error) { // 6. Fail-closed on verification failure return res.status(403).json({ allowed: false, message: `Sigstore admission rejected: ${error instanceof Error ? error.message : 'Cryptographic check failed'}` }); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Mandatory Sigstore Keyless OIDC Attestation & SLSA v1.0 Provenance Verification

Mandatory Sigstore Keyless OIDC Attestation & SLSA v1.0 Provenance Verification defines an industrial-grade behavioral standard for security engineering. Enforces strict admission-time cryptographic verification of container images using Sigstore keyless signatures and SLSA provenance attestations. Rejects long-lived static keys in favor of ephemeral Fulcio X.509 certificates verified against Rekor transparency logs with pinned OIDC issuer and subject SANs. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Admitting Images via Unscoped Static Keys or Bypassing Rekor Inclusion Proofs and Predicate Validation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Admitting Images via Unscoped Static Keys or Bypassing Rekor Inclusion Proofs and Predicate Validation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS resolve mutable image tags to immutable cryptographic sha256 digests before initiating any attestation verification.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.