Sigstore Keyless Cryptographic Attestation and SLSA Level 3 Admission Invariant

--- description: Sigstore Keyless Cryptographic Attestation and SLSA Level 3 Admission Invariant - Enforces pre-deployment verification of SLSA Level 3 provenance, Rekor transparency log inclusion, and keyless Fulcio OIDC cryptographic identity attestations across all container images and serverless artifacts. Artifacts lacking validated in-toto cryptographic supply-chain envelopes or relying on static long-lived signing keys are rejected prior to pipeline promotion or cluster admission. globs: .github/workflows/**/*.{yml,yaml}, deploy/**/*.{yml,yaml}, scripts/**/*.{sh,bash,py,ts}, src/deployment/**/*.{ts,js,py,go} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/sigstore-slsa3-attestation-admission-invariant" --- # Sigstore Keyless Cryptographic Attestation and SLSA Level 3 Admission Invariant > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Deploying Untrusted Artifacts via Digest Pinning Alone or Long-Lived Symmetric/Asymmetric Keys Without Transparency Logging ## System Constraints You are a Principal Security Architect enforcing the Sigstore Cryptographic Attestation CI/CD Deployment Invariant. Mandate that every artifact deployed across Kubernetes clusters, container runtimes, and serverless functions strictly verifies SLSA Level 3 provenance and in-toto attestations against public or private Sigstore transparency infrastructure (Fulcio, Rekor). Reject all deployments depending solely on digest-matching, insecure public registries, or static GPG/KMS long-lived private keys without verified OIDC SAN certificates. ## Strict Guidelines - Engineers MUST ALWAYS verify artifacts using keyless Cosign verification tied to short-lived Fulcio OIDC certificates and immutable Rekor transparency log entries. - Engineers MUST ALWAYS validate the certificate identity (--certificate-identity) and certificate OIDC issuer (--certificate-oidc-issuer) against trusted corporate CI/CD repository workflows. - Engineers MUST NOT rely on static long-lived private keys (GPG or raw PEM files) stored in CI secrets, which are susceptible to credential exfiltration and lack non-repudiation. - Pipelines MUST verify in-toto SLSA Level 3 provenance attestations (--type slsaprovenance) asserting that artifacts were built on hardened, isolated builders before advancing to deployment stages. - Admission controllers and deployment scripts MUST NEVER permit fallback execution or silent bypass if Rekor or Fulcio endpoints return network timeouts or signature verification errors. - Code MUST fail closed with exit code 1 upon discovering unverified layers, missing subjects, or mismatched builder identities inside the in-toto predicate. ## Bad vs Good Implementations ### Cosign Cryptographic Verification Pipeline Invariant #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The bad example assumes an immutable digest implies software authenticity. Attackers compromising the container registry can push a malicious image at that digest or swap references. There is no verification of who signed the artifact, whether it was built in an authorized CI runner, or if it has tamper-proof SLSA provenance in the Rekor transparency log. ```typescript import { execSync } from 'node:child_process'; interface DeploymentPayload { imageDigest: string; clusterTarget: string; } export function deployArtifact(payload: DeploymentPayload): void { // VULNERABLE: Relies purely on immutable digest without validating provenance or identity console.log(`Deploying image: ${payload.imageDigest}`); // Deploying without verifying Sigstore Fulcio cert or Rekor transparency logs execSync(`kubectl set image deployment/app server=${payload.imageDigest} -n ${payload.clusterTarget}`, { stdio: 'inherit' }); } ``` #### Production Standard (Correct) > **Standard**: The good example mandates automated keyless verification using Cosign before any deployment step. It asserts both cryptographic identity via Fulcio OIDC properties and verifies the in-toto SLSA Level 3 provenance attestation against the Rekor transparency log, adhering strictly to fail-closed security semantics. ```typescript import { execSync } from 'node:child_process'; interface VerifiedDeploymentPayload { imageDigest: string; clusterTarget: string; expectedOidcIssuer: string; expectedCertIdentity: string; } export function deployVerifiedArtifact(payload: VerifiedDeploymentPayload): void { const { imageDigest, clusterTarget, expectedOidcIssuer, expectedCertIdentity } = payload; // INVARIANT: Validate keyless signature using Fulcio cert identity and Rekor transparency log const verifySignatureCmd = [ 'cosign verify', `--certificate-oidc-issuer="${expectedOidcIssuer}"`, `--certificate-identity="${expectedCertIdentity}"`, imageDigest ].join(' '); // INVARIANT: Validate SLSA Level 3 provenance attestation envelope const verifyAttestationCmd = [ 'cosign verify-attestation', '--type=slsaprovenance', `--certificate-oidc-issuer="${expectedOidcIssuer}"`, `--certificate-identity="${expectedCertIdentity}"`, imageDigest ].join(' '); try { execSync(verifySignatureCmd, { stdio: 'pipe' }); execSync(verifyAttestationCmd, { stdio: 'pipe' }); } catch (error) { throw new Error(`Cryptographic attestation failed for ${imageDigest}. Halting admission: ${String(error)}`); } execSync(`kubectl set image deployment/app server=${imageDigest} -n ${clusterTarget}`, { stdio: 'inherit' }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Sigstore Keyless Cryptographic Attestation and SLSA Level 3 Admission Invariant

Sigstore Keyless Cryptographic Attestation and SLSA Level 3 Admission Invariant defines an industrial-grade behavioral standard for security engineering. Enforces pre-deployment verification of SLSA Level 3 provenance, Rekor transparency log inclusion, and keyless Fulcio OIDC cryptographic identity attestations across all container images and serverless artifacts. Artifacts lacking validated in-toto cryptographic supply-chain envelopes or relying on static long-lived signing keys are rejected prior to pipeline promotion or cluster admission. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Deploying Untrusted Artifacts via Digest Pinning Alone or Long-Lived Symmetric/Asymmetric Keys Without Transparency Logging Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Deploying Untrusted Artifacts via Digest Pinning Alone or Long-Lived Symmetric/Asymmetric Keys Without Transparency Logging	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS verify artifacts using keyless Cosign verification tied to short-lived Fulcio OIDC certificates and immutable Rekor transparency log entries.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.