Imported from bedkillerspacex-boop/codex-skill-library (
javascript-rekor-notes/SKILL.md). Install upstream withnpx skills add bedkillerspacex-boop/codex-skill-library --skill javascript-rekor-notes. Copyright stays with the author.
Javascript Rekor Notes
Scope And Authorization
- In scope: Adopting or verifying Sigstore/Rekor-backed signatures and provenance for containers, npm packages, and release artifacts your org produces or consumes.
- Out of scope: Circumventing signature checks; DoS against public Rekor; impersonation.
- Prefer official Sigstore roots and documented offline verification procedures.
- Redact private signing material; keys should be ephemeral (keyless) where possible.
- Pair with
javascript-sbom-generate,javascript-reproducible,javascript-release-gate.
When To Use
- Understanding Rekor’s role: append-only transparency log for signatures/attestations.
- Wiring GitHub Actions / CI to sign JS app container images with cosign keyless.
- Verifying
npmprovenance / sigstore attestations on consume side. - Writing ADRs on keyless vs long-lived keys for Node release pipelines.
Do Not Use As Primary
| Need | Skill instead |
|---|---|
| SBOM generate/consume | javascript-sbom-generate / javascript-sbom-consume |
| Reproducible builds | javascript-reproducible |
| OpenSSF Scorecard | javascript-scorecard-ossf |
| Registry mirror ops | javascript-registry-mirror |
| Implementation quality | code-quality-standards |
Concepts (short)
| Piece | Role |
|---|---|
| Fulcio | Issues short-lived certs bound to OIDC identity (e.g. GitHub workflow) |
| Rekor | Logs hash of signature/cert/payload for public auditability |
| Cosign | Signs/verifies OCI images and attachments |
| Provenance | Attestation (e.g. SLSA) about how artifact was built |
| Trust root | TUF-distributed Sigstore roots — pin updates carefully |
Property: Even if a key is stolen later, Rekor timestamps help detect when signing occurred; still need policy on which identities may sign your prod images.
Workflow
1. Confirm scope and success criteria
- Artifacts: container images, npm packages, CLI binaries.
- Success: CI signs on release; deploy verifies identity (
repo,workflow,ref); verification failure blocks prod; runbook for root updates. - Decide public Rekor vs private transparency log (rare; higher ops cost).
2. Inventory current signing
# Image present?
cosign tree ghcr.io/org/app:1.2.3 2>/dev/null || true
# npm provenance (package dependent)
npm view <pkg>@<ver> --json | rg dist || true3. CI sign pattern (containers)
# Conceptual GitHub Actions steps after build/push
- uses: sigstore/cosign-installer@v3
- run: cosign sign --yes ghcr.io/org/app:${{ github.sha }}
env:
COSIGN_YES: "true"
# Keyless uses OIDC of the workflow identityRecord expected identity:
Issuer: https://token.actions.githubusercontent.com
Subject: repo:ORG/REPO:ref:refs/tags/v*4. Verify before deploy
cosign verify \
--certificate-identity-regexp 'https://github.com/ORG/REPO/.*' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
ghcr.io/org/app:$DIGESTNode deploy job must fail closed on verify error.
5. npm / JS package notes
- Enable provider provenance where available (GitHub npm provenance).
- Consumers: prefer
npm audit signatures/ registry integrity; treat provenance as additional signal. - Private packages: ensure registry preserves attestation metadata (
javascript-registry-mirror).
6. Rekor entry inspection (incident/debug)
# Search by artifact hash (cosign/rekor-cli patterns evolve — pin tool versions)
rekor-cli get --uuid <uuid> 2>/dev/null || trueDocument in notes: what you store (digest → log UUID) for audit tickets.
7. Operational caveats
| Topic | Note |
|---|---|
| Keyless offline | Verify needs trust root bundle; cache for air-gap carefully |
| Identity drift | Tag vs branch workflows differ — pin regexp |
| Rekor availability | Public log dependency; plan retry; not a secrecy mechanism |
| Attestation vs signature | Separate policies for SBOM in-toto vs image sign |
Good / Bad
| Topic | Good | Bad |
|---|---|---|
| Identity | Verify repo+ref issuer | Any valid Fulcio cert |
| Deploy | Enforce cosign verify | Sign but never verify |
| Keys | Keyless OIDC | Long-lived cosign key in plaintext CI secret without rotation |
| Roots | Track Sigstore releases | Blind auto-update without test |
| Scope | Prod artifacts first | Sign random PR previews only |
Output Checklist
- Artifacts in scope listed
- CI signing enabled with least privilege identity
- Verify step in deploy with identity constraints
- Expected OIDC subject/issuer documented
- SBOM/provenance linked if used
- Trust root update process
- Incident: how to look up Rekor evidence
- Mirror/registry preserves attestations
- Fail-closed behavior tested
- ADR linked from runbook index
Rules
- Transparency ≠ secrecy; still protect build systems.
- Always verify identity attributes, not just “signed by someone”.
- Do not DDoS or abuse public Sigstore infrastructure.
- Focus on Rekor/Sigstore notes for JS supply chain.