SLSA Level 3 Ephemeral OIDC Provenance & Keyless Sigstore Attestation Standard

--- description: SLSA Level 3 Ephemeral OIDC Provenance & Keyless Sigstore Attestation Standard - Enforces non-forgeable, cryptographically auditable CI/CD artifact provenance using keyless Sigstore attestation backed by ephemeral OpenID Connect (OIDC) tokens. Eliminates long-lived signing keys while guaranteeing tamper-proof in-toto SLSA Level 3 provenance recorded in the Rekor transparency log. globs: .github/workflows/**/*.{yml,yaml}, scripts/**/*.{ts,js,sh}, infra/ci/**/*.{ts,json,yaml} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/slsa-l3-ephemeral-oidc-sigstore-attestation" --- # SLSA Level 3 Ephemeral OIDC Provenance & Keyless Sigstore Attestation Standard > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Persisting Long-Lived Private Keys in CI Secrets with Self-Attested Unverified Build Provenance ## System Constraints You are a Principal Engineer enforcing SLSA Level 3 Ephemeral OIDC Provenance & Sigstore Attestation. Mandate invariants that prevent forgeable build outputs, strictly prohibit long-lived static signing credentials, require ambient CI OIDC token exchange via Sigstore Fulcio, and verify inclusion in the Rekor transparency log with strict SAN validation. ## Strict Guidelines - Engineers MUST ALWAYS leverage ambient OIDC identity exchange with Fulcio to acquire short-lived X.509 signing certificates tied to the verifiable runner identity. - Engineers MUST NOT configure, inject, or persist static private keys (e.g., COSIGN_KEY, PGP secrets, or RSA PEM credentials) within CI/CD pipelines. - Pipelines MUST register every attestation bundle in an immutable transparency log (e.g., Rekor) and record the inclusion proof (SET / tlog index). - Provenance predicates MUST adhere strictly to the in-toto SLSA provenance specification (v0.2 or v1.0), capturing immutable source commit SHAs, builder parameters, and cryptographic material digests. - Downstream verification services MUST validate the certificate Subject Alternative Name (SAN), repository identity, and issuer URI, rather than solely checking cryptographic signature validity. ## Bad vs Good Implementations ### Cosign & Sigstore Verification via Ephemeral OIDC vs Static Secret Keying #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using long-lived static private keys introduces a critical vector for supply chain attacks: keys can be leaked, exfiltrated, or shared. Furthermore, this bypasses the public Rekor transparency log and Fulcio OIDC verification, failing SLSA Level 3 build integrity requirements. ```typescript import { execSync } from 'node:child_process'; // ANTI-PATTERN: Relies on persistent static private keys stored in CI secrets // Lacks transparency log checks, in-toto predicate validation, and SAN matching. export function signAndVerifyContainer(imageDigest: string): void { const privateKey = process.env.COSIGN_STATIC_PRIVATE_KEY; const keyPassword = process.env.COSIGN_PASSWORD; if (!privateKey || !keyPassword) { throw new Error('Missing static signing credentials in environment'); } // Signs using static key vulnerability; exposed to credential exfiltration execSync(`cosign sign --key env://COSIGN_STATIC_PRIVATE_KEY ${imageDigest}`); // Verifies only mathematical validity without checking build provenance or transparency logs execSync(`cosign verify --key env://COSIGN_STATIC_PUBLIC_KEY ${imageDigest}`); } ``` #### Production Standard (Correct) > **Standard**: Uses Sigstore keyless verification. It validates that the artifact attestation was signed using an ephemeral certificate minted by Fulcio via GitHub Actions OIDC, verifies entry into the Rekor transparency log, and validates the SAN identity against expected repository invariants. ```typescript import { verify } from '@sigstore/verify'; interface ProvenanceVerificationPolicy { expectedCertificateIssuer: string; expectedSanSubject: string; artifactDigest: string; attestationBundle: Record<string, unknown>; } // PRODUCTION FIX: Keyless verification using ephemeral Fulcio X.509 cert and Rekor inclusion log export async function verifySlsaProvenance(policy: ProvenanceVerificationPolicy): Promise<void> { const artifactBuffer = Buffer.from(policy.artifactDigest, 'hex'); // Verify attestation bundle against Sigstore Public Good Instance (or dedicated Sigstore stack) const result = await verify(policy.attestationBundle as any, artifactBuffer, { certificateIssuer: policy.expectedCertificateIssuer, certificateIdentityURI: policy.expectedSanSubject, tlogThreshold: 1, ctLogThreshold: 1 }); if (!result) { throw new Error('SLSA Provenance verification failed: invalid signature or missing transparency log record.'); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: SLSA Level 3 Ephemeral OIDC Provenance & Keyless Sigstore Attestation Standard

SLSA Level 3 Ephemeral OIDC Provenance & Keyless Sigstore Attestation Standard defines an industrial-grade behavioral standard for devops engineering. Enforces non-forgeable, cryptographically auditable CI/CD artifact provenance using keyless Sigstore attestation backed by ephemeral OpenID Connect (OIDC) tokens. Eliminates long-lived signing keys while guaranteeing tamper-proof in-toto SLSA Level 3 provenance recorded in the Rekor transparency log. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Persisting Long-Lived Private Keys in CI Secrets with Self-Attested Unverified Build Provenance Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Persisting Long-Lived Private Keys in CI Secrets with Self-Attested Unverified Build Provenance	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS leverage ambient OIDC identity exchange with Fulcio to acquire short-lived X.509 signing certificates tied to the verifiable runner identity.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.