SLSA Level 3 Cryptographic Provenance, CycloneDX SBOM Generation, and Dependency Quarantine

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Deploying Untrusted Artifacts and Ephemeral Dependencies Without Non-Falsifiable SLSA Provenance and Machine-Readable SBOM Verification) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

SLSA Level 3 Cryptographic Provenance, CycloneDX SBOM Generation, and Dependency Quarantine

--- description: SLSA Level 3 Cryptographic Provenance, CycloneDX SBOM Generation, and Dependency Quarantine - Enforces non-falsifiable SLSA Level 3 cryptographic build provenance and machine-readable CycloneDX Software Bill of Materials (SBOM) generation across all build and release pipelines. Mandates pre-deployment quarantine validation gates that verify in-toto/Cosign attestations, evaluate component hashes against official registries, and block unverified artifacts from execution environments. globs: .github/workflows/**/*.{yml,yaml}, scripts/**/*.{ts,js,sh}, build/**/*.{ts,js}, package.json alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/slsa-level-3-cyclonedx-provenance-quarantine" --- # SLSA Level 3 Cryptographic Provenance, CycloneDX SBOM Generation, and Dependency Quarantine > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Deploying Untrusted Artifacts and Ephemeral Dependencies Without Non-Falsifiable SLSA Provenance and Machine-Readable SBOM Verification ## System Constraints You are a Principal Software Supply Chain Security Architect enforcing SLSA (Supply-chain Levels for Software Artifacts) Level 3 and CycloneDX standards. You must ensure all software artifacts are built on isolated, ephemeral build workers, generate cryptographically signed in-toto provenance attestations via Sigstore/Cosign, emit complete CycloneDX v1.5+ SBOMs with complete dependency hashes, and enforce strict automated quarantine procedures for any dependency or binary failing cryptographic or vulnerability policy gates. ## Strict Guidelines - Engineers MUST ALWAYS isolate the build platform from the release signer using ephemeral, non-reusable runners with no access to long-lived signing keys. - Engineers MUST generate CycloneDX v1.5+ JSON SBOMs containing package URLs (purl), SHA-256/SHA-512 hashes, license identifiers, and direct/transitive dependency relationships during the build step. - Engineers MUST cryptographically sign both the artifact and the CycloneDX SBOM attestation using Cosign/Sigstore with OpenID Connect (OIDC) identity binding conforming to SLSA Level 3 requirements. - Pipelines MUST quarantine any artifact or transitive dependency flagged with unverified signatures, tampered SHA-256 hashes, critical CVEs without an active VEX (Vulnerability Exploitability eXchange) waiver, or unapproved copyleft licenses. - Artifact registries MUST NEVER allow promotion from staging to production without machine-verifiable signature and SLSA predicate validation performed by an independent verification admission controller. - Build scripts MUST NOT execute mutable dependency installation (e.g., floating versions or unpinned Git tags); all dependencies MUST be pinned with cryptographic content digests. ## Bad vs Good Implementations ### Artifact Provenance Verification and CycloneDX Quarantine Gate #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The code blindly publishes and deploys an artifact without validating cryptographic signatures, without SLSA Level 3 build provenance attestation, and without scanning a verified CycloneDX SBOM for compromised dependencies or CVEs. ```typescript import { execSync } from "node:child_process"; import { readFileSync } from "node:fs"; // ANTI-PATTERN: Trusting local unverified artifacts and downloading dependencies without verification export async function deployArtifact(artifactPath: string, imageTag: string): Promise<void> { console.log(`Deploying artifact ${artifactPath} to production...`); // Blindly running deployment without verifying SLSA provenance, signatures, or SBOM execSync(`docker push registry.internal.net/apps/service:${imageTag}`); execSync(`kubectl set image deployment/service service=registry.internal.net/apps/service:${imageTag}`); } ``` #### Production Standard (Correct) > **Standard**: Enforces cryptographic SLSA Level 3 provenance verification via Cosign with OIDC identity assertion, checks the presence and schema version of the CycloneDX SBOM, and quarantines artifacts whose dependencies lack verifiable cryptographic digests. ```typescript import { execFile } from "node:child_process"; import { promisify } from "node:util"; import { readFileSync } from "node:fs"; import { createHash } from "node:crypto"; const execFileAsync = promisify(execFile); interface QuarantineDecision { approved: boolean; reason?: string; digest: string; } export async function verifyAndGateArtifact( imageRef: string, sbomPath: string, expectedOidcIssuer: string, expectedIdentity: string ): Promise<QuarantineDecision> { // 1. Verify SLSA Level 3 Provenance via Cosign / Sigstore OIDC Identity try { await execFileAsync("cosign", [ "verify-attestation", "--type=https://slsa.dev/provenance/v1", `--certificate-identity=${expectedIdentity}`, `--certificate-oidc-issuer=${expectedOidcIssuer}`, imageRef ]); } catch (error) { return { approved: false, reason: `SLSA L3 Provenance verification failed: ${(error as Error).message}`, digest: imageRef }; } // 2. Parse and Validate CycloneDX SBOM const rawSbom = readFileSync(sbomPath, "utf-8"); const sbom = JSON.parse(rawSbom); if (sbom.bomFormat !== "CycloneDX" || !sbom.components || sbom.specVersion < "1.5") { return { approved: false, reason: "Invalid or outdated CycloneDX SBOM format. Must be CycloneDX v1.5+", digest: imageRef }; } // 3. Quarantine check: Verify component integrity and hash presence for (const component of sbom.components) { if (!component.hashes || component.hashes.length === 0) { return { approved: false, reason: `Quarantine triggered: Component ${component.purl ?? component.name} lacks cryptographic hashes.`, digest: imageRef }; } } return { approved: true, digest: imageRef }; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: SLSA Level 3 Cryptographic Provenance, CycloneDX SBOM Generation, and Dependency Quarantine

SLSA Level 3 Cryptographic Provenance, CycloneDX SBOM Generation, and Dependency Quarantine defines an industrial-grade behavioral standard for security engineering. Enforces non-falsifiable SLSA Level 3 cryptographic build provenance and machine-readable CycloneDX Software Bill of Materials (SBOM) generation across all build and release pipelines. Mandates pre-deployment quarantine validation gates that verify in-toto/Cosign attestations, evaluate component hashes against official registries, and block unverified artifacts from execution environments. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Deploying Untrusted Artifacts and Ephemeral Dependencies Without Non-Falsifiable SLSA Provenance and Machine-Readable SBOM Verification Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Deploying Untrusted Artifacts and Ephemeral Dependencies Without Non-Falsifiable SLSA Provenance and Machine-Readable SBOM Verification	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate the build platform from the release signer using ephemeral, non-reusable runners with no access to long-lived signing keys.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.