SLSA Level 3 Ephemeral Build Provenance and Keyless Cosign Attestation Guardrail

--- description: SLSA Level 3 Ephemeral Build Provenance and Keyless Cosign Attestation Guardrail - Enforces complete software supply-chain integrity by mandating immutable digest resolution, keyless Cosign cryptographic verification, and SLSA Level 3 provenance validation before any container or artifact is admitted to runtime environments. It strictly eliminates static long-lived private keys in favor of ephemeral Fulcio OIDC identity tokens anchored to Rekor transparency logs and isolated build runners. globs: .github/workflows/**/*.ya?ml, k8s/**/*.ya?ml, admission/**/*.{ts,js,go}, policies/**/*.{rego,cue}, src/deploy/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/slsa-l3-ephemeral-provenance-attestation-standard" --- # SLSA Level 3 Ephemeral Build Provenance and Keyless Cosign Attestation Guardrail > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Trusting Mutable Image Tags or Long-Lived Static Signing Keys Without Rekor Inclusion Proofs and SLSA Provenance Verification ## System Constraints You are a Principal Software Architect and Security Policy Authority enforcing SLSA Level 3 compliance and Sigstore/Cosign cryptographic verification across all deployment paths. Reject any workflow, admission webhook, or deployment pipeline that deploys unpinned artifact digests, relies on static cryptographic signing keys, or fails to rigorously parse in-toto SLSA provenance predicates against the trusted builder OIDC identity and Rekor transparency log proofs. ## Strict Guidelines - Deployments MUST NEVER reference mutable artifact tags (e.g., :latest, :v1.2.0); images and packages MUST be addressed strictly by their immutable cryptographic digest (e.g., @sha256:...). - Artifact admission logic MUST verify that container signatures and in-toto attestations are generated via keyless Sigstore infrastructure, validating Fulcio X.509 certificate extensions against immutable repository identities. - The admission gate MUST explicitly verify inclusion in the Rekor transparency log to prevent signature forgery and post-compromise key re-use. - Pipelines MUST enforce SLSA Provenance (v0.2 or v1.0) with predicateType 'https://slsa.dev/provenance/v1', strictly asserting that the 'builder.id' points to an isolated, hosted, tamper-proof runner environment (e.g., GitHub Actions reusable workflow or SLSA generator). - Artifact signing keys MUST NEVER be stored as long-lived secrets in repository variables or disk; signing MUST use ephemeral OpenID Connect (OIDC) identity tokens scoped solely to the build step. - Engineers MUST NOT disable provenance verification in development, staging, or production pipelines; missing or invalid attestation bundles MUST trigger hard failures. ## Bad vs Good Implementations ### Kubernetes Admission Webhook: SLSA L3 In-Toto Attestation & Keyless Verification #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The bad example permits mutable image tags, relies on a static public key prone to compromise, omits Rekor transparency verification, and fails to validate the in-toto SLSA Level 3 provenance predicate. An attacker with compromised credentials can sign a malicious payload or conduct a tag-swapping race condition attack. ```typescript // Insecure: Deploys using mutable tags and checks only basic signature without checking SLSA provenance or Fulcio OIDC claims import { Request, Response } from 'express'; import { execSync } from 'child_process'; export function validateAdmission(req: Request, res: Response): void { const image: string = req.body.request.object.spec.containers[0].image; try { // Vulnerability: Verifying mutable tag with long-lived static public key // Vulnerability: No check for Rekor transparency log or SLSA provenance payload execSync(`cosign verify --key /etc/keys/cosign.pub ${image}`); res.json({ response: { allowed: true } }); } catch (error) { res.json({ response: { allowed: false, status: { message: 'Signature check failed' } } }); } } ``` #### Production Standard (Correct) > **Standard**: The good implementation strictly validates that the container is pinned to a SHA-256 digest, enforces keyless Sigstore verification via GitHub Actions OIDC identity, confirms transparency logging, and decodes the in-toto payload to verify that the SLSA Level 3 builder environment matches the exact hardened builder specification. ```typescript // Industrial Grade: Enforces immutable digests, Sigstore Fulcio keyless OIDC claims, Rekor inclusion, and SLSA L3 provenance predicates import { Request, Response } from 'express'; import { execFileSync } from 'child_process'; interface AdmissionRequest { request: { object: { spec: { containers: Array<{ name: string; image: string }>; }; }; }; } const DIGEST_REGEX = /^[a-z0-9.-]+(?::[0-9]+)?\/[a-z0-9-_/]+@sha256:[a-f0-9]{64}$/; const EXPECTED_ISSUER = 'https://token.actions.githubusercontent.com'; const EXPECTED_BUILDER = 'https://github.com/actions/runner'; const EXPECTED_WORKFLOW_REF = 'org/repo/.github/workflows/release.yml@refs/heads/main'; export function validateAdmission(req: Request, res: Response): void { const payload = req.body as AdmissionRequest; const container = payload?.request?.object?.spec?.containers?.[0]; const image = container?.image; if (!image || !DIGEST_REGEX.test(image)) { res.status(400).json({ response: { allowed: false, status: { message: 'Image must be specified by immutable cryptographic digest (@sha256:...)' } } }); return; } try { // 1. Verify keyless signature and Rekor log inclusion against Fulcio OIDC claims execFileSync('cosign', [ 'verify', '--certificate-oidc-issuer', EXPECTED_ISSUER, '--certificate-identity-regexp', `^https://github.com/${EXPECTED_WORKFLOW_REF}$`, image ], { encoding: 'utf-8', timeout: 5000 }); // 2. Verify SLSA v1 in-toto provenance attestation const attestationRaw = execFileSync('cosign', [ 'verify-attestation', '--type', 'slsaprovenance1', '--certificate-oidc-issuer', EXPECTED_ISSUER, '--certificate-identity-regexp', `^https://github.com/${EXPECTED_WORKFLOW_REF}$`, image ], { encoding: 'utf-8', timeout: 5000 }); const attestationEnvelope = JSON.parse(attestationRaw.split('\n')[0]); const predicate = JSON.parse(Buffer.from(attestationEnvelope.payload, 'base64').toString('utf-8')); // 3. Enforce SLSA Level 3 builder isolation invariants if (predicate.predicateType !== 'https://slsa.dev/provenance/v1' || predicate.predicate?.runDetails?.builder?.id !== EXPECTED_BUILDER) { throw new Error('SLSA Provenance does not satisfy SLSA Level 3 isolated runner guarantees'); } res.json({ response: { allowed: true } }); } catch (error: unknown) { const message = error instanceof Error ? error.message : 'Attestation failure'; res.status(403).json({ response: { allowed: false, status: { message: `Admission rejected by SLSA L3 policy: ${message}` } } }); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: SLSA Level 3 Ephemeral Build Provenance and Keyless Cosign Attestation Guardrail

SLSA Level 3 Ephemeral Build Provenance and Keyless Cosign Attestation Guardrail defines an industrial-grade behavioral standard for security engineering. Enforces complete software supply-chain integrity by mandating immutable digest resolution, keyless Cosign cryptographic verification, and SLSA Level 3 provenance validation before any container or artifact is admitted to runtime environments. It strictly eliminates static long-lived private keys in favor of ephemeral Fulcio OIDC identity tokens anchored to Rekor transparency logs and isolated build runners. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Trusting Mutable Image Tags or Long-Lived Static Signing Keys Without Rekor Inclusion Proofs and SLSA Provenance Verification Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Trusting Mutable Image Tags or Long-Lived Static Signing Keys Without Rekor Inclusion Proofs and SLSA Provenance Verification	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Deployments MUST NEVER reference mutable artifact tags (e.g.,

Deployments MUST NEVER reference mutable artifact tags (e.g., :latest, :v1.2.0); images and packages MUST be addressed strictly by their immutable cryptographic digest (e.g., @sha256:...).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.