Skip to main content

H-13 Signing

Brick H of the Enterprise AI Platform. Technology: Cosign (Sigstore) keyless with OIDC or keys in OpenBao/KMS; signs images, SBOMs, skills and plugins. French version: ../../fr/bricks/H-13-signing.md.

Role and responsibilities​

  • Sign artifacts and verify signatures at deploy (Kyverno) and at load (Skill Loader, plugin install).

Position and interactions​

  • Execution path: workflow (CI) and admission verification.
  • POST /v1/skills/{name}/verify uses the same trust roots.

Open source and developed parts​

  • Open source reused: Cosign, Rekor (optional private instance), Fulcio.
  • Developed in the platform: Trust policy per tenant (allowed identities).

Data model​

No dedicated table: state lives in Kubernetes objects, Git and the tool's own storage; actions are audited in eai.audit_events through the Control Plane when they go through the API.

Contract: contracts/v1/skill-manifest.schema.json (schema_version 1.0). Usage is always reported with contracts/v1/usage-event.schema.json, audit with contracts/v1/audit-event.schema.json.

API endpoints​

MethodPath
POST/v1/policies/evaluate

POST /v1/policies/evaluate​

Request:

{
  "action": "image.deploy",
  "resource": {
    "type": "image",
    "digest": "sha256:ab12"
  },
  "context": {
    "signed": true,
    "critical_vulns": 0
  }
}

Response:

{
  "allow": true,
  "reasons": [],
  "decision_id": "dec_44"
}

SDK examples​

Python​

from enterprise_ai import EnterpriseAI

client = EnterpriseAI(base_url="<control-plane-url>", api_key="eai_live_xxx", tenant="acme", locale="en")
client.policies.evaluate(request={"action": "image.deploy", "resource": {"type": "image", "digest": "sha256:ab12"}})

TypeScript​

import { EnterpriseAI } from "@enterprise-ai/sdk";

const client = new EnterpriseAI({ baseUrl: "<control-plane-url>", apiKey: process.env.EAI_API_KEY, tenant: "acme", locale: "en" });
await client.policies.evaluate({ action: "image.deploy", resource: { type: "image", digest: "sha256:ab12" } });

Java​

EnterpriseAIClient client = EnterpriseAIClient.builder()
    .baseUrl("<control-plane-url>")
    .apiKey(System.getenv("EAI_API_KEY"))
    .tenant("acme")
    .locale(Locale.ENGLISH)
    .build();
client.policies().evaluate(Map.of("action", "image.deploy", "resource", Map.of("type", "image", "digest", "sha256:ab12")));

Go​

client, err := eai.NewClient(eai.WithBaseURL("<control-plane-url>"), eai.WithAPIKey(os.Getenv("EAI_API_KEY")), eai.WithTenant("acme"), eai.WithLocale("en"))
if err != nil { log.Fatal(err) }
ctx := context.Background()
_, err = client.Policies.Evaluate(ctx, map[string]any{"action": "image.deploy", "resource": map[string]any{"type": "image", "digest": "sha256:ab12"}})

Configuration​

Environment variables: EAI_COSIGN_KEY, EAI_COSIGN_IDENTITY, EAI_COSIGN_OIDC_ISSUER.

Security​

  • Signing keys never leave KMS; keyless identities restricted to CI workloads.
  • Tenant resolved from the credential, never from the body; PostgreSQL row level security on every tenant table.
  • Every mutation and policy decision writes a hash chained audit event (G-11).
  • Errors use the standard envelope with message_i18n en and fr.

Observability​

  • Verification failures per artifact.
  • W3C traceparent propagated, X-Request-Id returned, spans carry eai.tenant_id, eai.project, eai.agent_id, eai.run_id.

FinOps units​

  • Not applicable.

Failure modes and resilience​

  • Rekor unreachable -> offline bundle verification.

Standalone adoption​

Clients publishing their own skills sign them with their identity.

Acceptance tests​

  1. An unsigned skill is refused by the Skill Loader.

Implementation roadmap