Join us

ContentUpdates and recent posts about Sigstore..
Story
@laura_garcia shared a post, 7 months, 3 weeks ago
Software Developer, RELIANOID

🔎 Understanding VRF (Virtual Routing and Forwarding)

VRF enables secure traffic isolation, scalability, and multi-tenant networking on a single infrastructure. In our latest article, we explain how it works, key benefits, and how RELIANOID implements per-NIC VRF to enhance security and flexibility 🚀 👉 Read more in the full article! https://www.reliano..

kb VRF Virtual routing and forwarding
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

Self-replicating worm hits 180+ npm packages in (largely) automated supply chain attack

A supply chain worm called **Shai-hulud** is loose in the npm wild. It's not just lurking—it’s replicating through npm packages, lifting developer tokens, and injecting tainted versions of real, maintained libraries. Once in, it grabs GitHub secrets, flips private repos public, and piggybacks on Gi.. read more  

Self-replicating worm hits 180+ npm packages in (largely) automated supply chain attack
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

MCP vulnerability case study: SQL injection in the Postgres MCP server

A nasty SQL injection bug in Anthropic’s now-retiredPostgres MCP serverlet attackers blow past read-only mode and run whatever SQL they wanted. The repo got archived back in May 2025—but it’s far from dead. The unpatched package still racks up21,000 NPM installsand1,000 Docker pullsevery week... read more  

Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

GitHub Copilot Custom Chat Modes: AI Personas that Match Your Needs

GitHub Copilot Chat just jot better in **VS Code 1.101** with **Custom Chat Modes**. Devs can now drop Markdown files into their workspace to shape Copilot’s persona—tone, tools, constraints, the works. Want an AI buddy for security audits? Or a test-writing machine with zero patience for flaky cod.. read more  

GitHub Copilot Custom Chat Modes: AI Personas that Match Your Needs
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

How In-Memory Caching Works in Redis

Redis isn’t just a cache anymore. Sure, it still owns the in-memory speed game—with **key expiration**, **data persistence**, and **horizontal scaling** via **replication** and **clustering**. But if you're only using it to stash a few keys, you're missing the point. This thing handles **streams**,.. read more  

How In-Memory Caching Works in Redis
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

Experimenting with local LLMs on macOS

Running **open-weight LLMs locally on macOS**? This post breaks it down clean. It compares **llama.cpp**—great for tweaking things—to **LM Studio**, which trades control for simplicity. Covers what fits in memory, which quantized models to grab (hint: 4-bit GGUF), and what’s coming down the pipe: *.. read more  

Experimenting with local LLMs on macOS
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

TIOBE Programming Index News September 2025: Perl Regains the Spotlight

Perl 5 has risen to **10th place in the TIOBE Index**, increasing in popularity even though the exact reason is unknown. Perl 6, or Raku, lags behind Perl 5 in rankings and has not seen the same rise in attention. Other top languages like C and Java have experienced slight falls in rankings... read more  

Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

Using Claude Code to modernize a 25-year-old kernel driver

A long-dead Linux kernel driver for QIC-80 tape drives just got dragged into the present—with help from **Claude Code** and a lot of tinkering. It now builds cleanly and runs as a **standalone module** on **Linux 6.8**, playing nice with modern setups like **Xubuntu 24.04**. **The bigger picture:**.. read more  

Using Claude Code to modernize a 25-year-old kernel driver
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

Building an AI Server on a Budget ($1.3K)

A developer rolled their own AI server for $1.3K—Ubuntu 24.04.2 LTS, an Nvidia RTX GPU, and a sharp eye on Tensor cores, VRAM, and resale value. The rig handles small models locally and punts big jobs to the cloud when needed. Local-first, cloud-when-it-counts... read more  

Building an AI Server on a Budget ($1.3K)
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

You Vibe It, You Run It?

Vibe Coding lets developers create software by chatting with AI, skipping traditional coding. But the non-determinism of AI prompts poses significant risks for reliability and maintainability, potentially leading to addiction-like dependence on this new tool. Think twice before fully embracing this .. read more  

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.