Goal

Deliver the V1 "Closed Supply Chain" acceptance bar for AICR bundles and recipe data:

every artifact (binary, image, recipe data, bundle) has retrievable provenance and a documented verification path that works in air-gapped, private, and public-trust deployments

This epic tracks the two halves that are not yet shipped — signing in enterprise environments and the matching verification path — plus recipe-data provenance and the end-user verification guide. (Build-time provenance for binaries and images already ships.)

Signing lives in pkg/bundler/attestation/ (SignStatement in signing.go, the attester resolver in resolver.go) and uses sigstore-go's sign package. Verification lives in pkg/bundler/verifier/ (aicr verify → verifySigstoreBundle), which today only checks keyless bundles against the public-good trusted root (trust.GetTrustedMaterial()).

Signing sub-issues

Verification & provenance sub-issues

Signing without a matching verification path breaks the chain at the consumer. Each signing mode needs its verify counterpart:

Plus the peer workstreams:

• feat: recipe-data provenance (signed catalog/registry) #1155 — recipe-data provenance (signed catalog/registry); recipe data is a V1 artifact, not part of bundle signing.
• docs: verify-on-deploy path for signed bundles #1156 — verify-on-deploy: documented deploy-time verification path (admission / GitOps) per signing mode.
• docs: end-user artifact verification guide #1157 — end-user verification guide covering air-gapped, private, and public-trust verification.

Suggested sequencing

1. feat(bundle): private Sigstore infrastructure support via --fulcio-url and --rekor-url #408 — quick independent win, no dependencies.
2. bundle --attest: no OIDC token caching across runs (every invocation triggers new Rekor entry) #685 — standalone iteration improvement; independent (non-V1-blocking).
3. feat(bundle): KMS-backed signing for CI/CD environments without OIDC #407 — the foundation; unblocks air-gap, server-side, and KMS verification.
4. feat(bundle): air-gapped signing with --tlog-upload=false for restricted networks #409 + feat(verify): KMS public-key verification (aicr verify --key) #1152 + feat(verify): private Sigstore trust root for bundle verification #1153 — air-gapped signing and the KMS / private-trust verify counterparts (ride on feat(bundle): KMS-backed signing for CI/CD environments without OIDC #407 / feat(bundle): private Sigstore infrastructure support via --fulcio-url and --rekor-url #408).
5. feat(verify): offline / air-gapped verification (skip tlog) #1154 — offline verify (rides on feat(verify): KMS public-key verification (aicr verify --key) #1152).
6. feat(server): bundle attestation for /v1/bundle (non-interactive signing) #1150 — server-side signing (rides on feat(bundle): KMS-backed signing for CI/CD environments without OIDC #407).
7. feat: recipe-data provenance (signed catalog/registry) #1155 / docs: verify-on-deploy path for signed bundles #1156 / docs: end-user artifact verification guide #1157 — recipe-data provenance and the docs, once the feature surfaces they describe exist.

Success criteria

• Each signing mode produces a bundle that is verifiable by aicr verify in the same environment: KMS-signed → --key; private-Sigstore-signed → private trust root; air-gapped → offline, no network calls.
• A bundle generated via POST /v1/bundle can be returned signed using a non-interactive identity (feat(server): bundle attestation for /v1/bundle (non-interactive signing) #1150).
• Recipe data carries retrievable, verifiable provenance (feat: recipe-data provenance (signed catalog/registry) #1155).
• A published end-user guide (docs: end-user artifact verification guide #1157) documents the verification path for each deployment shape, and a deploy-time enforcement path exists (docs: verify-on-deploy path for signed bundles #1156).
• Each lands with passing make test / make lint and docs updated.

Scope

In scope: the sub-issues above — signing changes in pkg/cli/bundle.go / pkg/bundler/attestation/, verification changes in pkg/cli / pkg/bundler/verifier/, server changes in pkg/server / pkg/client/v1 (#1150), recipe-data work in pkg/recipe (#1155), and docs.

Out of scope: build-time provenance for binaries/images (already shipped); changes to the in-toto predicate/statement shape; new attestation types. New gaps surfaced while implementing should be filed as standalone issues and attached here.

Correctness notes (verified 2026-06-02)

The four original issues were filed before signing migrated to sigstore-go and before the headless-OIDC flows landed; each body was refreshed for accuracy:

• feat(bundle): KMS-backed signing for CI/CD environments without OIDC #407: implementation notes rewritten — signing no longer uses cosign's Go SignerVerifier/cosign.LoadKeyFromKMS(); KMS now means a key-based signer in the sigstore-go path and will add dependencies.
• feat(bundle): private Sigstore infrastructure support via --fulcio-url and --rekor-url #408: scoped down — SignOptions.FulcioURL/RekorURL already exist with default fallback, so only CLI wiring is left.
• feat(bundle): air-gapped signing with --tlog-upload=false for restricted networks #409: confirmed accurate; added the concrete code location (SignStatement unconditionally wires sign.NewRekor).
• bundle --attest: no OIDC token caching across runs (every invocation triggers new Rekor entry) #685: stale line ref fixed (bundle.go:510 → selectAttester; token acquired in ResolveAttesterLazy); "Related" updated since --oidc-device-flow / --identity-token / ambient have shipped.
• All four: removed references to a non-existent aicr bundle-sign subcommand — signing is aicr bundle --attest.