Sigstore Rekor In-Toto Attestation & Ephemeral OIDC Verification Standard

--- description: Sigstore Rekor In-Toto Attestation & Ephemeral OIDC Verification Standard - Mandates strict cryptographic provenance verification of keyless Sigstore signatures, Rekor transparency log inclusion proofs, and In-Toto attestations before container image admission. Validates short-lived Fulcio X.509 certificates against sub-second ephemeral OIDC claims to prevent supply-chain spoofing, compromised long-lived credentials, and admission of unverified container digests. globs: src/admission/**/*.{ts,js,go}, src/security/**/*.{ts,js,go}, infra/k8s/admission/**/*.{yaml,json,ts}, policies/**/*.{yaml,rego} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/sigstore-rekor-intoto-ephemeral-identity-verification" --- # Sigstore Rekor In-Toto Attestation & Ephemeral OIDC Verification Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Trusting unverified image digests, ignoring Rekor inclusion proofs, or bypassing ephemeral OIDC SAN identity matching in admission controllers. ## System Constraints You are a Principal Security Architect enforcing the Sigstore Rekor In-Toto Attestation Ephemeral Identity Verification Standard. You must strictly require that all container images admitted into clusters have their cryptographic identity validated using Sigstore bundles containing Fulcio-issued ephemeral X.509 certificates, Rekor transparency log inclusion proofs, and In-Toto SLSA predicates. Never allow admission based solely on image tags, unverified public keys, or relaxed OIDC claims. ## Strict Guidelines - Admission webhooks MUST ALWAYS resolve mutable tags to immutable SHA256 digests before signature evaluation. - Engineers MUST ALWAYS verify cryptographic inclusion proofs against the immutable Rekor transparency log Merkle tree root. - Engineers MUST NEVER trust static, long-lived PGP/RSA keys; signatures MUST use Fulcio ephemeral certificates tied to cryptographic OIDC identity tokens. - Admission controllers MUST validate exact OIDC Subject Alternative Name (SAN) claims, including SAN URI, issuer, and repository workflow identity, rejecting wildcard identities. - Services MUST verify the In-Toto attestation predicate payload (e.g., SLSA Provenance v1.0) and confirm that the builder identity matches the authenticated OIDC workload identity. - Verification routines MUST assert that the signature timestamp falls precisely within the validity window of the short-lived Fulcio certificate before admission acceptance. ## Bad vs Good Implementations ### Enforcing Cryptographic Sigstore Bundle and Ephemeral OIDC Claims in Admission Logic #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The handler validates an image without resolving its immutable SHA256 digest, blindly accepts the presence of a signature bundle without verifying the Rekor inclusion proof or Signed Entry Timestamp (SET), and uses a dangerously permissive substring check (`includes('github.com')`) on the certificate SAN, allowing arbitrary attacker-controlled GitHub runners to satisfy admission criteria. ```typescript import { Request, Response } from 'express'; interface AdmissionRequestBody { image: string; signatureBundle?: any; } // INSECURE: Bypasses Rekor transparency log proof and accepts wildcards/unverified OIDC identities export async function handleAdmissionReview(req: Request, res: Response) { const { image, signatureBundle } = req.body as AdmissionRequestBody; // Flaw 1: Accepts mutable tags without resolving to immutable digest if (!image.startsWith('registry.internal.net/')) { return res.status(403).json({ allowed: false, message: 'Invalid registry' }); } // Flaw 2: Trusts presence of a bundle without Rekor SET verification or Fulcio cert validation if (signatureBundle && signatureBundle.signedEntryTimestamp) { // Flaw 3: Insecure identity check with permissive matching const certSubject = signatureBundle.certificate?.subjectAltName || ''; if (certSubject.includes('github.com')) { return res.status(200).json({ allowed: true }); } } return res.status(403).json({ allowed: false, message: 'Signature missing' }); } ``` #### Production Standard (Correct) > **Standard**: The invariant-compliant handler enforces immutable SHA256 image references, cryptographically verifies the Sigstore bundle against Rekor and Fulcio roots, enforces exact non-wildcard OIDC SAN and Issuer matching, and strictly confirms Rekor log inclusion before granting admission. ```typescript import { Request, Response } from 'express'; import { verify, Bundle, VerifierOptions } from '@sigstore/verify'; interface ValidatedAdmissionPayload { imageDigest: string; bundle: Bundle; } const TRUSTED_OIDC_ISSUER = 'https://token.actions.githubusercontent.com'; const TRUSTED_SAN_URI = 'https://github.com/enterprise-org/secure-service/.github/workflows/build.yml@refs/heads/main'; const EXPECTED_DIGEST_REGEX = /^registry\.internal\.net\/[a-z0-9_-]+@sha256:[a-f0-9]{64}$/; export async function handleAdmissionReview(req: Request, res: Response): Promise<Response> { const { imageDigest, bundle } = req.body as ValidatedAdmissionPayload; if (!imageDigest || !EXPECTED_DIGEST_REGEX.test(imageDigest)) { return res.status(400).json({ allowed: false, message: 'Image must be pinned to an immutable SHA256 digest' }); } const verifierOptions: VerifierOptions = { rekorLogPublicKeys: [process.env.REKOR_PUBLIC_KEY!], fulcioCertificateChain: [process.env.FULCIO_ROOT_CA!], ctLogPublicKeys: [process.env.CTLOG_PUBLIC_KEY!], keyless: { identities: [ { issuer: TRUSTED_OIDC_ISSUER, san: { type: 'URI', value: TRUSTED_SAN_URI } } ] } }; try { const artifactDigestBytes = Buffer.from(imageDigest.split('@sha256:')[1], 'hex'); const verificationResult = await verify(bundle, artifactDigestBytes, verifierOptions); const rekorEntry = verificationResult.tlogEntries?.[0]; if (!rekorEntry || !rekorEntry.integratedTime) { return res.status(403).json({ allowed: false, message: 'Rekor inclusion proof verification missing or invalid' }); } return res.status(200).json({ allowed: true, digest: imageDigest }); } catch (error) { return res.status(403).json({ allowed: false, message: `Sigstore attestation verification failed: ${(error as Error).message}` }); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Sigstore Rekor In-Toto Attestation & Ephemeral OIDC Verification Standard

Sigstore Rekor In-Toto Attestation & Ephemeral OIDC Verification Standard defines an industrial-grade behavioral standard for security engineering. Mandates strict cryptographic provenance verification of keyless Sigstore signatures, Rekor transparency log inclusion proofs, and In-Toto attestations before container image admission. Validates short-lived Fulcio X.509 certificates against sub-second ephemeral OIDC claims to prevent supply-chain spoofing, compromised long-lived credentials, and admission of unverified container digests. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Trusting unverified image digests, ignoring Rekor inclusion proofs, or bypassing ephemeral OIDC SAN identity matching in admission controllers. Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Trusting unverified image digests, ignoring Rekor inclusion proofs, or bypassing ephemeral OIDC SAN identity matching in admission controllers.	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Admission webhooks MUST ALWAYS resolve mutable tags to immutable SHA256 digests before signature evaluation.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.