Infrastructure

Red Hat Trusted Artifact Signer deployment and endpoint availability.

OIDC

Identity provider configuration for keyless signing.

Signing

Container image signing setup in CI/CD pipelines.

Verification

Signature verification setup in CI/CD pipelines.

Policy

Admission control and governance on Kubernetes or OpenShift.

Supply Chain

SBOM generation, attestation, and provenance tracking.

Critical

Blocks Red Hat Trusted Artifact Signer integration. Must be resolved before signing can work.

High

Significantly impacts security or functionality. Should be resolved before production use.

Medium

Recommended for production readiness. Can be deferred to later iterations.

Low

Best practice that improves supply chain security posture. Optional but recommended.

INFRA-001

Critical

A Red Hat Trusted Artifact Signer instance must be deployed and accessible.

Deploy Red Hat Trusted Artifact Signer using the OpenShift operator or Ansible collection. See Red Hat Trusted Artifact Signer Deployment Guide.

INFRA-002

Critical

The Fulcio server must be reachable for certificate issuance.

Verify the Fulcio pod is running. Check route or ingress configuration. Verify network policies allow traffic.

INFRA-003

Critical

The Rekor transparency log must be reachable for log entries.

Verify the Rekor pod is running. Check route or ingress configuration.

INFRA-004

High

TUF root metadata must be available for cosign initialization.

Verify the TUF pod is running. Ensure the TUF root has been initialized.

INFRA-005

Medium

The Timestamp Authority should be reachable for RFC 3161 timestamps.

Verify the TSA pod is running. TSA is optional but recommended for production use.

INFRA-006

Critical

The cosign CLI must be installed in the CI/CD environment.

Install cosign via package manager, container image, or binary download. See Cosign installation guide.

OIDC-001

Critical

An OIDC issuer must be configured in Fulcio for identity-based signing.

Configure the OIDC issuer in the Fulcio configuration and pass it via the --oidc-issuer flag to cosign.

OIDC-002

Critical

An OIDC client ID must match the Fulcio-registered client.

Set --oidc-client-id to the value registered in Fulcio, typically trusted-artifact-signer for Red Hat Trusted Artifact Signer.

OIDC-003

Critical

An OIDC identity token must be obtainable in the CI/CD environment.

Enable OIDC token generation for your CI platform, or configure Keycloak service account credentials.

OIDC-004

High

The OIDC provider’s discovery endpoint must be reachable from the CI runner.

Check network connectivity, DNS resolution, and TLS trust for the OIDC provider.

OIDC-005

Medium

The OIDC provider type and configuration must be detected to determine token acquisition patterns. For Keycloak providers, client type (public vs confidential) affects the grant type used.

If client type is unknown, confirm the supported grant type or consult provider metadata. For non-Keycloak providers in Jenkins, consider adding Keycloak/RHBK as a secondary issuer for CI/CD automation.

SIGN-001

Critical

The CI/CD pipeline must include a container image signing step.

Add a signing step to the pipeline using the cosign sign command.

SIGN-002

Critical

The --fulcio-url flag must point to the Red Hat Trusted Artifact Signer Fulcio instance for keyless signing.

Add --fulcio-url=<fulcio_url> to the cosign sign command.

SIGN-003

Critical

The --rekor-url flag or COSIGN_REKOR_URL must point to the Red Hat Trusted Artifact Signer Rekor instance.

Add --rekor-url=<rekor_url> or set COSIGN_REKOR_URL=<rekor_url>.

SIGN-004

High

Cosign must be initialized with the Red Hat Trusted Artifact Signer TUF root before signing.

Set the pinned TAS_TUF_ROOT_CHECKSUM CI/CD variable during trusted setup, then add : "${TAS_TUF_ROOT_CHECKSUM:?Set the pinned checksum}"; cosign initialize --mirror=<tuf_url> --root=<tuf_url>/1.root.json --root-checksum="$tas_tuf_root_checksum" before signing. Never derive the checksum from the downloaded root in the pipeline.

SIGN-005

Medium

The --yes flag should be set for non-interactive CI/CD signing.

Add --yes to cosign sign commands in CI/CD pipelines.

VERIFY-001

High

The pipeline should include a signature verification step.

Add a verification step using cosign verify after deployment.

VERIFY-002

High

The --certificate-identity or --certificate-identity-regexp must be set for keyless verification.

Add --certificate-identity=<expected_identity> to cosign verify.

VERIFY-003

High

The --certificate-oidc-issuer must match the signing OIDC issuer.

Add --certificate-oidc-issuer=<oidc_issuer> to cosign verify.

VERIFY-004

Medium

Verification must use the Red Hat Trusted Artifact Signer trust configuration for private TAS rather than relying on public Sigstore defaults.

Initialize Cosign with the Red Hat Trusted Artifact Signer TUF mirror and verified root, or pass the Red Hat Trusted Artifact Signer --trusted-root or trusted bundle. Do not add --private-infrastructure solely because TAS is private; use it only when required by the exact supported legacy Cosign version and document the reduced transparency checks.

POLICY-001

Medium

A policy controller should enforce signature verification on Kubernetes deployments.

Install the Sigstore policy-controller and create ClusterImagePolicy resources.

POLICY-002

Medium

A ClusterImagePolicy should define which images require signatures and the trusted identities.

Create a ClusterImagePolicy matching your image registry and signing identity.

SUPPLY-001

Low

The pipeline should generate a Software Bill of Materials (SBOM).

Add SBOM generation using Syft, Trivy, or a similar tool.

SUPPLY-002

Low

The SBOM should be attached to the container image as an attestation via cosign.

Add cosign attest --predicate=<sbom_file> --type=spdxjson or --type=cyclonedx.

SUPPLY-003

Low

Build provenance (SLSA) should be attached as an attestation.

Add SLSA provenance generation and attach via cosign attest --type=slsaprovenance.