SLSA Level 4 Hermetic Build Provenance and Sigstore Keyless Admission Verification

--- description: SLSA Level 4 Hermetic Build Provenance and Sigstore Keyless Admission Verification - Enforces SLSA Level 4 build compliance and Sigstore keyless cryptographic verification across deployment pipelines and cluster admission webhooks. Guarantees that container images and artifacts are built in hermetically isolated, ephemeral environments with non-forgeable in-toto attestations backed by Fulcio ephemeral certificates and Rekor transparency log proofs. Blocks unverified or tampered binaries, mutable container tags, and static long-lived private keys from cluster execution. globs: .github/workflows/**/*.{yml,yaml}, deploy/**/*.{yml,yaml}, k8s/**/*.{yml,yaml}, policy/**/*.{yml,yaml}, src/admission/**/*.{ts,js,go} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/slsa-l4-sigstore-keyless-provenance-guardrail" --- # SLSA Level 4 Hermetic Build Provenance and Sigstore Keyless Admission Verification > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Admitting Artifacts via Mutable Tags or Static Signatures Without Rekor and Hermetic Attestation ## System Constraints You are a Principal Software Architect and Security Auditor enforcing SLSA Level 4 Hermetic Build Provenance and Sigstore Keyless Verification. You must mandate that every container image and binary is pinned strictly by immutable cryptographic digest (sha256). You must reject any build system relying on ambient network access, mutable tags, or static signing keys. Enforce that admission controllers and deployment scripts cryptographically verify Sigstore bundles—validating Fulcio OIDC certificates against authorized issuer identity, ensuring verified inclusion proofs in the Rekor transparency log, and inspecting in-toto provenance attestations for hermetic build parameters before allowing container execution. ## Strict Guidelines - Engineers MUST ALWAYS reference deployment artifacts by immutable SHA-256 digest (`image@sha256:...`) and never rely on mutable tags alone. - Engineers MUST NOT use long-lived, static private keys for artifact signing; all signatures MUST use Sigstore keyless OIDC flows via Fulcio and Rekor. - Build systems MUST execute in isolated, ephemeral, hermetic environments where network egress during compilation is strictly prohibited or restricted to authenticated, content-addressed dependency mirrors. - Admission verification logic MUST explicitly validate the Fulcio certificate Subject Alternative Name (SAN) and OIDC Issuer against explicit trusted identities, rather than simply checking signature existence. - Admission verification logic MUST verify Rekor transparency log inclusion proofs and timestamps to prevent revocation race conditions and untracked artifact releases. - Pipelines MUST produce in-toto SLSA v1.0 / v0.2 provenance predicates validating that the builder identity matches an authorized ephemeral workflow running on hardened runners. ## Bad vs Good Implementations ### Cluster Admission Verification: Keyless Sigstore Bundle & In-toto Predicate Check #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The code uses mutable image references, performs no cryptographic verification against Rekor or Fulcio, accepts unverified headers instead of authenticating in-toto attestations, and fails to enforce SLSA Level 4 provenance predicates. ```typescript import { Request, Response } from 'express'; // ANTI-PATTERN: Only checks if an image has a tag and skims signature presence // Uses mutable tags, ignores Rekor log proof, and allows arbitrary signers export async function validateAdmission(req: Request, res: Response) { const pod = req.body.request.object; const container = pod.spec.containers[0]; const image = container.image; // Flaw 1: Mutable tag used directly without digest pinning if (image.endsWith(':latest')) { return res.status(400).json({ allowed: false, message: 'latest tag disallowed' }); } // Flaw 2: Sham signature check; doesn't verify Fulcio OIDC SAN or Rekor inclusion const hasSignature = req.headers['x-artifact-signature']; if (!hasSignature) { return res.status(403).json({ allowed: false, message: 'Unsigned image' }); } return res.json({ allowed: true }); } ``` #### Production Standard (Correct) > **Standard**: Enforces immutable digest pinning, cryptographically verifies the Sigstore bundle against Rekor transparency log proofs, enforces the exact Fulcio OIDC issuer and repository identity, and validates the SLSA v1 provenance predicate for hermetic builds. ```typescript import { Request, Response } from 'express'; import { verify } from '@sigstore/verify'; interface AdmissionRequest { imageUri: string; sigstoreBundle: any; } const TRUSTED_OIDC_ISSUER = 'https://token.actions.githubusercontent.com'; const TRUSTED_SAN_IDENTITY = 'https://github.com/enterprise-org/secure-repo/.github/workflows/hermetic-build.yml@refs/heads/main'; const DIGEST_REGEX = /@[a-f0-9]{64}$/; export async function validateAdmission(req: Request<{}, {}, AdmissionRequest>, res: Response) { const { imageUri, sigstoreBundle } = req.body; // Invariant 1: Ensure strict digest pinning if (!DIGEST_REGEX.test(imageUri)) { return res.status(400).json({ allowed: false, message: 'Image must be pinned to an immutable SHA-256 digest' }); } try { // Invariant 2: Sigstore keyless verification with Fulcio & Rekor enforcement const artifactBuffer = Buffer.from(imageUri); const result = await verify(sigstoreBundle, artifactBuffer, { keyless: { issuer: TRUSTED_OIDC_ISSUER, subject: TRUSTED_SAN_IDENTITY }, tlogOptions: { threshold: 1 // Mandate presence in Rekor transparency log } }); // Invariant 3: Verify SLSA L4 hermetic provenance predicate inside attestation const statement = JSON.parse(result.statement); if ( statement.predicateType !== 'https://slsa.dev/provenance/v1' || statement.predicate.buildDefinition.buildType !== 'https://slsa.dev/container-based-build/v1' || statement.predicate.buildDefinition.internalParameters?.hermetic !== true ) { return res.status(403).json({ allowed: false, message: 'Artifact fails SLSA Level 4 hermetic build verification' }); } return res.json({ allowed: true }); } catch (error: any) { return res.status(403).json({ allowed: false, message: `Cryptographic admission verification failed: ${error.message}` }); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: SLSA Level 4 Hermetic Build Provenance and Sigstore Keyless Admission Verification

SLSA Level 4 Hermetic Build Provenance and Sigstore Keyless Admission Verification defines an industrial-grade behavioral standard for security engineering. Enforces SLSA Level 4 build compliance and Sigstore keyless cryptographic verification across deployment pipelines and cluster admission webhooks. Guarantees that container images and artifacts are built in hermetically isolated, ephemeral environments with non-forgeable in-toto attestations backed by Fulcio ephemeral certificates and Rekor transparency log proofs. Blocks unverified or tampered binaries, mutable container tags, and static long-lived private keys from cluster execution. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Admitting Artifacts via Mutable Tags or Static Signatures Without Rekor and Hermetic Attestation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Admitting Artifacts via Mutable Tags or Static Signatures Without Rekor and Hermetic Attestation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS reference deployment artifacts by immutable SHA-256 digest (`image@sha256

Engineers MUST ALWAYS reference deployment artifacts by immutable SHA-256 digest (`image@sha256:...`) and never rely on mutable tags alone.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.