feat(bundle): add --tlog-upload flag for air-gapped KMS signing

Signed-off-by: Brian Lockwood <lockwobr@gmail.com>

Author: lockwobr

docs/contributor/rekor-v2-signing.md

@@ -114,6 +114,16 @@ TUF v2 config (default), then a Rekor v1 URL.
   `KMSAttester` builds its transparency policy through the same
   `transparencyForOptions` path as keyless signing, so both stay in lockstep. A
   KMS v2 entry carries public-key verification material (no Fulcio certificate).
+- `--tlog-upload=false` (KMS only) skips the Rekor upload entirely for fully
+  offline / air-gapped signing (#409). It sets `ResolveOptions.DisableTLogUpload`,
+  which wires `NewKMSAttester(..., WithoutTransparencyLog())`; the attester's
+  `HasRekorEntry()` then reports false and `Attest` attaches no transparency log.
+  The flag is rejected on the keyless path, because keyless OIDC signing needs
+  Fulcio and Rekor network access, and is mutually exclusive with `--rekor-url`
+  and `--signing-config`: those select a transparency-log target, which cannot be
+  reconciled with writing no entry (the no-tlog policy would silently override
+  them, so it fails closed instead). Verify such a bundle with
+  `aicr verify --key <uri> --insecure-ignore-tlog`.
 
 `--rekor-url` and `--signing-config` are mutually exclusive, so an operator's
 private Rekor is never silently overridden by the v2 default.

docs/user/cli-reference.md

@@ -1275,6 +1275,7 @@ aicr bundle [flags]
 | `--rekor-url` | | string | Sign the `--attest` bundle to **Rekor v1** at this URL instead of the **Rekor v2 default** (a private Sigstore instance, or the public-good v1 URL). Must be an absolute `https://` URL with no embedded credentials. Also reads `AICR_REKOR_URL`. Independent of `--fulcio-url`. Mutually exclusive with `--signing-config`. |
 | `--signing-config` | | string | Sign the `--attest` bundle with a custom Sigstore signing config JSON instead of the default Rekor v2 config (advanced — e.g. an edited config or a private v2 instance). Also reads `AICR_SIGNING_CONFIG`. Mutually exclusive with `--rekor-url`. |
 | `--signing-key` | | string | Sign the `--attest` bundle with a KMS-backed key instead of keyless OIDC, for CI/CD environments without OIDC (Jenkins, internal pipelines). Takes a KMS URI; supported schemes are `awskms://`, `gcpkms://`, `azurekms://`, and `hashivault://`. Like keyless signing, KMS signs to Rekor v2 by default; opt out with `--rekor-url` (v1) or `--signing-config` (custom). Mutually exclusive with `--identity-token`, `--oidc-device-flow`, and `--fulcio-url` (the keyless-only flags); passing both is a validation error. See [KMS-Backed Signing](#kms-backed-signing). |
+| `--tlog-upload` | | bool | Upload the signature to the Rekor transparency log (default: `true`). Set `--tlog-upload=false` to skip the Rekor upload for fully offline / air-gapped signing; this requires `--signing-key` (KMS), because keyless OIDC signing needs Fulcio and Rekor network access to mint a verifiable certificate. Mutually exclusive with `--rekor-url` and `--signing-config` (both select where the transparency-log entry goes, which contradicts writing none). Verify the resulting bundle offline with `aicr verify --key <public-key.pem> --insecure-ignore-tlog`; use a local PEM public key for a fully offline verify, since a KMS `--key` URI still makes a live `GetPublicKey` call. See [KMS-Backed Signing](#kms-backed-signing). |
 | `--yes` | `--assume-yes` | bool | Skip the interactive confirmation shown before keyless signing publishes your OIDC identity (browser/device-code paths only; the banner is still printed). Reads `AICR_ASSUME_YES`. See [Privacy: identity in keyless signatures](#privacy-identity-in-keyless-signatures). |
 
 `--image-refs` writes the published digest through a mode-`0600` temporary
@@ -2338,6 +2339,25 @@ Like keyless signing, KMS signs to **Rekor v2** by default. Opt out with
 `--signing-config` to use a custom signing config; the two opt-outs are mutually
 exclusive with each other but both compose with `--signing-key`.
 
+For a fully offline / air-gapped signing host that cannot reach any Rekor
+instance, add `--tlog-upload=false`. KMS signing then skips the transparency-log
+upload entirely and the bundle carries no Rekor entry:
+
+```shell
+aicr bundle --recipe recipe.yaml --attest \
+  --signing-key awskms://arn:aws:kms:us-east-1:123456789012:key/abcd-1234 \
+  --tlog-upload=false \
+  --output ./bundles
+```
+
+`--tlog-upload=false` requires `--signing-key`; it is rejected on the keyless
+path, because keyless OIDC signing needs Fulcio and Rekor network access to mint
+a verifiable certificate. Verify an air-gapped bundle offline with
+`aicr verify --key <public-key.pem> --insecure-ignore-tlog`, which skips the
+transparency-log lookup that would otherwise require network access. Use a local
+PEM public key (exported once with `cosign public-key --key <kms-uri>`) for a
+fully offline verify: a KMS `--key` URI still makes a live `GetPublicKey` call.
+
 The resulting bundle uses the same Sigstore bundle format as keyless signing,
 but its verification material is the signing key's public key rather than a
 Fulcio certificate.

pkg/bundler/attestation/kms.go

@@ -40,23 +40,42 @@ type KMSAttester struct {
 
 	// tlog, when non-nil, overrides the transparency policy that Attest would
 	// otherwise compute from target. Used to inject a no-tlog policy for offline
-	// testing, and reserved for a future --tlog-upload=false opt-out (#409).
+	// testing, and wired to the --tlog-upload=false opt-out via
+	// WithoutTransparencyLog for offline / air-gapped signing (#409).
 	tlog TransparencyPolicy
 }
 
+// KMSAttesterOption customizes a KMSAttester at construction time.
+type KMSAttesterOption func(*KMSAttester)
+
+// WithoutTransparencyLog makes the attester skip the Rekor upload (offline /
+// air-gapped signing, #409). The resulting attester's HasRekorEntry reports
+// false and Attest writes no transparency-log entry.
+func WithoutTransparencyLog() KMSAttesterOption {
+	return func(k *KMSAttester) { k.tlog = NewNoTLogPolicy() }
+}
+
 // NewKMSAttester returns a KMSAttester for keyURI. Like keyless signing, KMS
 // signs to Rekor v2 by default (via the TUF-distributed signing config, which
 // also supplies the timestamp authority v2 requires) unless target opts out to a
 // Rekor v1 URL or a custom signing config. target is produced by
 // SignOptionsFromResolve so the KMS path shares the keyless path's signing-target
 // mapping. The transparency-log entry carries public-key verification material
 // (no Fulcio certificate). See #1650.
-func NewKMSAttester(keyURI string, target SignOptions) *KMSAttester {
-	return &KMSAttester{
+//
+// opts customize the attester; WithoutTransparencyLog opts out of the Rekor
+// upload for offline / air-gapped signing (#409). With no options the Rekor
+// upload behavior is unchanged.
+func NewKMSAttester(keyURI string, target SignOptions, opts ...KMSAttesterOption) *KMSAttester {
+	k := &KMSAttester{
 		keyURI:   keyURI,
 		identity: NewKMSIdentity(keyURI),
 		target:   target,
 	}
+	for _, opt := range opts {
+		opt(k)
+	}
+	return k
 }
 
 // Attest creates a DSSE-signed in-toto SLSA provenance statement for the given

pkg/bundler/attestation/kms_test.go

@@ -33,6 +33,33 @@ func TestKMSAttesterContract(t *testing.T) {
 	}
 }
 
+// TestKMSAttesterWithoutTransparencyLog verifies the functional option opts the
+// attester out of the Rekor upload: HasRekorEntry reports false, while a
+// default (no-option) attester still reports true. See #409.
+func TestKMSAttesterWithoutTransparencyLog(t *testing.T) {
+	const keyURI = "gcpkms://projects/p/locations/l/keyRings/r/cryptoKeys/k"
+
+	cases := []struct {
+		name      string
+		opts      []KMSAttesterOption
+		wantRekor bool
+	}{
+		{"default records a Rekor entry", nil, true},
+		{"WithoutTransparencyLog records no entry", []KMSAttesterOption{WithoutTransparencyLog()}, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			a := NewKMSAttester(keyURI, SignOptions{UseTUFSigningConfig: true}, tc.opts...)
+			if a.HasRekorEntry() != tc.wantRekor {
+				t.Errorf("HasRekorEntry() = %v, want %v", a.HasRekorEntry(), tc.wantRekor)
+			}
+			if a.Identity() != keyURI {
+				t.Errorf("Identity = %q, want %q", a.Identity(), keyURI)
+			}
+		})
+	}
+}
+
 // TestKMSAttesterAttest exercises Attest end-to-end offline by injecting a
 // fake key-based identity (local ECDSA signer, no cert provider) and the
 // no-tlog policy, so no KMS provider or Rekor call is made. It asserts the
@@ -63,4 +90,10 @@ func TestKMSAttesterAttest(t *testing.T) {
 	if b.GetVerificationMaterial().GetPublicKey() == nil {
 		t.Error("want public-key verification material for KMS signing")
 	}
+	// The no-tlog policy must produce a bundle with no transparency-log entries:
+	// assert directly on Attest's output (HasRekorEntry only reports the policy
+	// choice, not the emitted bundle).
+	if got := len(b.GetVerificationMaterial().GetTlogEntries()); got != 0 {
+		t.Errorf("no-tlog KMS attestation carries %d tlog entries, want 0", got)
+	}
 }

pkg/bundler/attestation/resolver.go

@@ -75,6 +75,18 @@ type ResolveOptions struct {
 	// CLI boundary (pkg/cli). See issue #407.
 	SigningKey string
 
+	// DisableTLogUpload skips the Rekor transparency-log upload for KMS
+	// (SigningKey) signing, enabling fully offline / air-gapped bundle
+	// attestation (#409). The zero value (false) is the safe default: a caller
+	// constructing ResolveOptions without setting it still gets a Rekor entry.
+	//
+	// It affects ONLY the KMS path. Keyless (OIDC) signing ignores this field
+	// and always uploads to Rekor, because keyless needs Fulcio + Rekor network
+	// access to produce a verifiable certificate; that is a fail-safe. The CLI
+	// boundary (pkg/cli) rejects DisableTLogUpload without a SigningKey so a
+	// keyless caller cannot silently expect an offline signature.
+	DisableTLogUpload bool
+
 	// PromptWriter receives user-facing prompts emitted by the interactive
 	// and device-code flows (verification URL + short code). Pass os.Stderr
 	// for typical CLI behavior, io.Discard to suppress, or nil (treated as
@@ -167,7 +179,11 @@ func ResolveAttester(ctx context.Context, opts ResolveOptions) (Attester, error)
 		return NewNoOpAttester(), nil
 	}
 	if opts.SigningKey != "" {
-		return NewKMSAttester(opts.SigningKey, SignOptionsFromResolve("", opts)), nil
+		var kopts []KMSAttesterOption
+		if opts.DisableTLogUpload {
+			kopts = append(kopts, WithoutTransparencyLog())
+		}
+		return NewKMSAttester(opts.SigningKey, SignOptionsFromResolve("", opts), kopts...), nil
 	}
 	token, err := ResolveOIDCToken(ctx, opts)
 	if err != nil {
@@ -195,7 +211,11 @@ func ResolveAttesterLazy(_ context.Context, opts ResolveOptions) (Attester, erro
 		return NewNoOpAttester(), nil
 	}
 	if opts.SigningKey != "" {
-		return NewKMSAttester(opts.SigningKey, SignOptionsFromResolve("", opts)), nil
+		var kopts []KMSAttesterOption
+		if opts.DisableTLogUpload {
+			kopts = append(kopts, WithoutTransparencyLog())
+		}
+		return NewKMSAttester(opts.SigningKey, SignOptionsFromResolve("", opts), kopts...), nil
 	}
 	return NewLazyKeylessAttester(opts), nil
 }

pkg/bundler/attestation/resolver_test.go

@@ -240,6 +240,75 @@ func TestResolveAttesterLazyKMS(t *testing.T) {
 	}
 }
 
+// TestResolveAttesterDisableTLogUpload verifies DisableTLogUpload wires the
+// no-tlog override onto the KMS attester (offline / air-gapped signing) for
+// both the eager and lazy resolvers, and only when SigningKey is set. Keyless
+// signing (SigningKey empty) ignores the flag and always uploads. See #409.
+func TestResolveAttesterDisableTLogUpload(t *testing.T) {
+	const keyURI = "awskms://arn:aws:kms:us-east-1:111:key/abc"
+
+	resolvers := []struct {
+		name    string
+		resolve func(ResolveOptions) (Attester, error)
+	}{
+		{"eager", func(o ResolveOptions) (Attester, error) {
+			return ResolveAttester(context.Background(), o)
+		}},
+		{"lazy", func(o ResolveOptions) (Attester, error) {
+			return ResolveAttesterLazy(context.Background(), o)
+		}},
+	}
+
+	cases := []struct {
+		name      string
+		opts      ResolveOptions
+		wantKMS   bool // attester must (KMS) / must not (keyless) be a *KMSAttester
+		wantRekor bool // expected HasRekorEntry()
+	}{
+		{
+			// KMS + DisableTLogUpload:true → no Rekor entry.
+			name:      "kms uploads disabled",
+			opts:      ResolveOptions{Attest: true, SigningKey: keyURI, DisableTLogUpload: true},
+			wantKMS:   true,
+			wantRekor: false,
+		},
+		{
+			// KMS + DisableTLogUpload:false (default) → Rekor entry.
+			name:      "kms default uploads",
+			opts:      ResolveOptions{Attest: true, SigningKey: keyURI},
+			wantKMS:   true,
+			wantRekor: true,
+		},
+		{
+			// Keyless (no SigningKey) + DisableTLogUpload:true → still a keyless
+			// attester that always uploads; the flag is ignored on this path.
+			name:      "keyless ignores disable and uploads",
+			opts:      ResolveOptions{Attest: true, IdentityToken: "tok", DisableTLogUpload: true},
+			wantKMS:   false,
+			wantRekor: true,
+		},
+	}
+
+	for _, r := range resolvers {
+		t.Run(r.name, func(t *testing.T) {
+			for _, tc := range cases {
+				t.Run(tc.name, func(t *testing.T) {
+					att, err := r.resolve(tc.opts)
+					if err != nil {
+						t.Fatalf("resolve: %v", err)
+					}
+					if _, ok := att.(*KMSAttester); ok != tc.wantKMS {
+						t.Fatalf("attester type = %T, want *KMSAttester: %v", att, tc.wantKMS)
+					}
+					if att.HasRekorEntry() != tc.wantRekor {
+						t.Errorf("HasRekorEntry() = %v, want %v", att.HasRekorEntry(), tc.wantRekor)
+					}
+				})
+			}
+		})
+	}
+}
+
 // TestResolveAttesterLazy_DefersTokenResolution verifies the lazy entry
 // point does not touch the OIDC chain at construction time. Constructing
 // a lazy attester with a pre-canceled context plus a forced device-flow