Join us

ContentUpdates and recent posts about Sigstore..
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

Magical systems thinking

AI now writes over **25% of Google’s** and as much as **90% of Anthropic’s** code. That’s not a trend—it’s a regime change. Still, the mess in large public systems reminds us: clever analysis isn’t enough. Complex systems don’t behave; they misbehave. When the machines are churning out code, the .. read more  

Magical systems thinking
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

Writing an operating system kernel from scratch

A barebonestime-sharing OS kernel, written inZig, running onRISC-V. It leans onOpenSBIfor console I/O and timer interrupts. Threads? Statically allocated, each running inuser mode (U-mode). The kernel stays insupervisor mode (S-mode), where it catchessystem callsandcontext switchesvia timer ticks. .. read more  

Writing an operating system kernel from scratch
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

PostgreSQL maintenance without superuser

PostgreSQL’s moving in on superusers. As of recent releases—starting way back in v9.6 and maturing through PostgreSQL 18 (coming 2025)—there are now **15+ built-in admin roles**. No need to hand out superuser just to get things done. These roles cover the ops spectrum: monitoring, backups, fil.. read more  

PostgreSQL maintenance without superuser
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

Accelerate serverless testing with LocalStack integration in VS Code IDE

The AWS Toolkit for VS Code now hooks straight into **LocalStack**. Run full end-to-end tests for **serverless workflows**—Lambda, SQS, EventBridge, the whole crew—without bouncing between tools or writing boilerplate. Just deploy to LocalStack from the IDE using the **AWS SAM CLI**. It feels like .. read more  

Accelerate serverless testing with LocalStack integration in VS Code IDE
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

SLI Evolution Stages

A new SLI evolution model lays out a maturity roadmap—from rebranded latency/error metrics to ones that actually track business impact. It replaces shallow signals and pulls in the stuff that matters: how service failures hit user goals, tasks, and bottom lines... read more  

SLI Evolution Stages
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

%CPU Utilization Is A Lie

Stress tests on the Ryzen 9 5900X uncovered a big gap between **reported CPU utilization** and what the chip actually pushes. Around 50% on paper? Could mean close to full throttle in reality—thanks to sneaky behaviors from **SMT resource sharing** and **Turbo frequency scaling**. **Takeaway:** Raw.. read more  

%CPU Utilization Is A Lie
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

Introducing Budget Controls for AWS: Automatically Manage Your Cloud Costs

**Budget Controls for AWS** just got better. The open-source tool now reins in more than just EC2. It wrangles **RDS Aurora**, **SageMaker**, and **OpenSearch** too. Under the hood, it taps **AWS Budgets**, **AWS Config**, and **custom tags** to watch spend like a hawk. Hit a budget threshold? It c.. read more  

Introducing Budget Controls for AWS: Automatically Manage Your Cloud Costs
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

Best 20 Linux Commands for Daily Use in Production Servers

A fresh roundup drops20 go-to Linux commandsfor production sysadmins, dialing in on modern defaults likehtop > top,ss > netstat, andip > ifconfig. The shift? Faster tools that actually get updates. Built with systemd in mind, too. Expect the usual suspects—journalctl,rsync,crontab—all still pulling.. read more  

Best 20 Linux Commands for Daily Use in Production Servers
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

Fast, Secure Kubernetes with AKS Automatic

Azure dropped **AKS Automatic**, a new managed Kubernetes tier that tries to do it all—so you don’t have to. It comes with baked-in best practices: autoscaling via HPA, VPA, KEDA, and Karpenter. Automated patching. Node repair. Monitoring. All wired up by default. You still get full access to the .. read more  

Fast, Secure Kubernetes with AKS Automatic
Link
@faun shared a link, 7 months, 3 weeks ago
FAUN.dev()

v1.34: Recovery From Volume Expansion Failure (GA)

Kubernetes v1.34 bumps **automated recovery from botched PVC expansions** to GA. Users can now fix bad volume size requests—no admin, no drama. It cleans up unused quota, slows down retry spam, and surfaces progress with new PVC status fields... read more  

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.