SLSA Level 3 Ephemeral OIDC Container Attestation Invariant

--- description: SLSA Level 3 Ephemeral OIDC Container Attestation Invariant - Enforces non-falsifiable, cryptographically signed SLSA Level 3 provenance attestations generated via ephemeral OpenID Connect (OIDC) workload identity federation. Eliminates long-lived CI/CD signing keys and prevents artifact deployment promotion without strictly validated in-toto provenance statements anchored in a tamper-evident transparency log. globs: .github/workflows/**/*.{yml,yaml}, src/deploy/**/*.{ts,js}, scripts/pipeline/**/*.{ts,js}, infra/k8s/**/*.{yaml,yml} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/slsa-l3-ephemeral-oidc-container-attestation-invariant" --- # SLSA Level 3 Ephemeral OIDC Container Attestation Invariant > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Promoting Container Artifacts Using Static Signing Keys or Unverified OIDC Issuer Claims Without Provenance Validation ## System Constraints You are a Principal Software Architect enforcing SLSA Level 3 provenance and ephemeral OIDC keyless container attestation invariants. You must mandate that every container artifact build generates non-falsifiable provenance via isolated ephemeral runners, signs using short-lived OIDC workload identities (e.g., Sigstore Fulcio), records attestations to a public or private transparency log (Rekor), and verifies specific OIDC issuer/subject claims before any stage or environment promotion. ## Strict Guidelines - Engineers MUST ALWAYS verify container signatures and in-toto provenance attestations against an immutable cryptographic digest (sha256:...) and NEVER against mutable image tags. - Engineers MUST NOT utilize static, long-lived asymmetric private keys (e.g., AWS KMS master keys with static credentials, GPG, or hardcoded secrets) for container artifact signing in CI/CD pipelines. - CI/CD workflows MUST request ephemeral, ambient OIDC tokens with minimum scopes (id-token: write) and exchange them directly with a short-lived CA (such as Sigstore Fulcio) to derive ephemeral X.509 signing certificates. - Deployment promotion gates MUST cryptographically parse and validate the SLSA provenance predicate (https://slsa.dev/provenance/v1) confirming the expected builder identity, source repository, commit SHA, and workflow entry point. - Promotion services MUST reject artifacts if the transparency log entry (Rekor) is missing, contains an untrusted timestamp, or does not resolve to an immutable ledger inclusion proof. - Admission controllers and deployment scripts NEVER permit promotion of containers where the OIDC claims (e.g., issuer, repository, ref, workflow) diverge from the authorized release governance policy. ## Bad vs Good Implementations ### Verifying SLSA v1.0 Provenance and Ephemeral OIDC Claims Pre-Promotion #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Verifies a mutable image tag using a static public key instead of an immutable digest and short-lived OIDC certificate. Fails to verify in-toto provenance (SLSA predicate), transparency log inclusion, or CI/CD source claims, exposing the deployment to man-in-the-middle tag mutation and compromised build environments. ```typescript import { execSync } from 'node:child_process'; interface DeploymentParams { imageName: string; tag: string; } export async function promoteContainer({ imageName, tag }: DeploymentParams): Promise<void> { // Anti-pattern: Relies on mutable tag and static signing key validation // Lacks SLSA Level 3 provenance verification and ambient OIDC claims inspection const imageRef = `${imageName}:${tag}`; console.log(`Verifying image ${imageRef} using static public key...`); const isSigned = execSync(`cosign verify --key env://STATIC_COSIGN_PUB ${imageRef}`).toString(); if (!isSigned.includes('The following checks were performed')) { throw new Error('Image signature verification failed'); } console.log(`Promoting unverified provenance container: ${imageRef}`); } ``` #### Production Standard (Correct) > **Standard**: Pins the container by cryptographic sha256 digest, validates keyless Fulcio certificates against expected OIDC claims, enforces Rekor transparency log inclusion, and inspects the SLSA v1.0 provenance predicate to ensure the artifact was compiled in an isolated, verified CI runner. ```typescript import { verify, PolicyConfig } from '@sigstore/verify'; interface PromotionSpec { repository: string; immutableDigest: `sha256:${string}`; expectedRepo: string; expectedWorkflow: string; expectedBranch: string; } export async function promoteContainerStrictSLSA3(spec: PromotionSpec): Promise<void> { // Invariant 1: Mandate pinning by immutable SHA256 digest const artifactRef = `${spec.repository}@${spec.immutableDigest}`; // Invariant 2: Define strict OIDC identity criteria matching Fulcio root of trust const verificationPolicy: PolicyConfig = { certificateIssuer: 'https://token.actions.githubusercontent.com', certificateIdentityURIRegex: new RegExp( `^https://github.com/${spec.expectedRepo}/.github/workflows/${spec.expectedWorkflow}@refs/heads/${spec.expectedBranch}$` ), ctlog: { threshold: 1, }, tlog: { threshold: 1, // Enforce Rekor transparency log proof of inclusion }, }; // Invariant 3: Verify provenance attestation envelope and SLSA v1.0 predicate const attestationResult = await verify(artifactRef, verificationPolicy); const slsaPredicate = attestationResult.find( (statement) => statement.type === 'https://slsa.dev/provenance/v1' ); if (!slsaPredicate) { throw new Error(`SLSA Level 3 violation: No valid provenance attestation found for ${artifactRef}`); } const { builder, buildDefinition } = slsaPredicate.predicate; if (builder.id !== 'https://github.com/actions/runner') { throw new Error(`Untrusted builder identity: ${builder.id}`); } if (buildDefinition.externalParameters.source !== `https://github.com/${spec.expectedRepo}`) { throw new Error('Provenance source repository mismatch'); } console.log(`SLSA Level 3 Verified. Promoting artifact: ${artifactRef}`); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: SLSA Level 3 Ephemeral OIDC Container Attestation Invariant

SLSA Level 3 Ephemeral OIDC Container Attestation Invariant defines an industrial-grade behavioral standard for security engineering. Enforces non-falsifiable, cryptographically signed SLSA Level 3 provenance attestations generated via ephemeral OpenID Connect (OIDC) workload identity federation. Eliminates long-lived CI/CD signing keys and prevents artifact deployment promotion without strictly validated in-toto provenance statements anchored in a tamper-evident transparency log. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Promoting Container Artifacts Using Static Signing Keys or Unverified OIDC Issuer Claims Without Provenance Validation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Promoting Container Artifacts Using Static Signing Keys or Unverified OIDC Issuer Claims Without Provenance Validation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS verify container signatures and in-toto provenance attestations against an immutable cryptographic digest (sha256

Engineers MUST ALWAYS verify container signatures and in-toto provenance attestations against an immutable cryptographic digest (sha256:...) and NEVER against mutable image tags.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.