Updates and recent posts about Sigstore..

Posts
Description

Link

@devopslinks shared a link, 1 week, 4 days ago

FAUN.dev()

Top 10 best practices for Amazon EMR Serverless

Amazon EMR Serverless allows users to run big data analytics frameworks without managing clusters, integrating with various AWS services for a comprehensive solution. The top 10 best practices for optimizing EMR Serverless workloads focus on performance, cost, and scalability, including consideratio.. read more

Link

@devopslinks shared a link, 1 week, 4 days ago

FAUN.dev()

AI Isn't Replacing SREs. It's Deskilling Them.

This post discusses the impact of AI on the role of Site Reliability Engineers (SREs) by drawing parallels to historical research on automation. It highlights the risk of deskilling and never-skilling for SREs who heavily rely on AI tools for incident response. The post also suggests potential appro.. read more

Course

@eon01 published a course, 1 week, 4 days ago

Founder, FAUN.dev

Learn Git in a Day

#DevOps #version... #vcs #git #gitlab

Everything you need, nothing you don't

Activity

@shurup gave 🐾 to Helm Cheat Sheet: Everything You Need to Know to Start Using Helm , 2 weeks ago.

Story Palark Team Trending

@shurup shared a post, 2 weeks ago

@palark

Kubernetes best practices for DevOps engineers

#k8s #contain... #Contain... #best pr... #kuberne...

Have to manage Kubernetes in production but don’t feel confident about its many moving parts, complex architecture, and configurations? Here’s a selection of technical guides from experienced engineers for Kubernetes beginners looking to master this orchestration tool for running containerised apps efficiently and reliably.

Link

@pramod_kumar_0820 shared a link, 2 weeks ago

Software Engineer, Teknospire

⚡ Why Your Spring Boot API Takes 3 Seconds to Respond (And How to Fix It)

A practical breakdown of the most common Spring Boot performance bottlenecks — and how we optimized our API from 3 seconds to 200 ms.

News FAUN.dev() Team Trending

@devopslinks shared an update, 2 weeks ago

FAUN.dev()

Microsoft Project Silica: Your Data, Stored in a Pyrex Dish, for 10,000 Years

#technol... #Silica #Voxels #Data St... #Microso...

Microsoft's Project Silica encodes data in borosilicate glass using femtosecond lasers, offering long-term storage for up to 10,000 years. This method overcomes traditional storage limitations and is cost-effective, though write speed remains a challenge. The research phase is complete, but no product release has been announced.

Microsoft Project Silica: Your Data, Stored in a Pyrex Dish, for 10,000 Years

News FAUN.dev() Team Trending

@varbear shared an update, 2 weeks, 1 day ago

FAUN.dev()

Operating Systems as Age Gatekeepers: The Law That Could Reshape the Internet

#Digital... #linux #age ver... #operati... #Califor...

California's Digital Age Assurance Act mandates operating systems to share users' age data with app developers via a real-time API by 2027. The law faces criticism for depending on self-reported ages, potentially affecting its efficacy.

Link

@varbear shared a link, 2 weeks, 2 days ago

FAUN.dev()

The Great Developer Divide: How AI Is Reshaping the Software Job Market Into Three Tiers

AI hiring has split dev work into three camps:Apex Tier,Hybrid Middle, and a shrinkingAutomatable Tail. Demand now favorsAI orchestration,prompt engineering, fastcode reading, and platform roles likeplatform engineer,fleet supervisor, andAI QA. System shift:Organizations must rework career ladders, .. read more

Link

@varbear shared a link, 2 weeks, 2 days ago

FAUN.dev()

I deleted my laptop from my dev workflow. My iPhone does the job now

A developer ditches the laptop and SSHs from an iPhone into an always-onMac Mini. The phone becomes a terminal and browser. The remote runs the dev server, theClaude Code/CodexCLI, hot reload, file watching, and pushes viaTailscale. Persistent sessions (tmux) keep AI agents and services alive across.. read more

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.