Join us

ContentUpdates and recent posts about Sigstore..
Link
@varbear shared a link, 2 weeks, 2 days ago
FAUN.dev()

We Might All Be AI Engineers Now

The author supervises AI agents that orchestrate concurrent graph traversal, multi-layer hashing, AST parsing, and file system watchers. The agents run traversal, hashing, and watcher loops. The engineer architects system behavior, verifies outputs, and probes agents in parallel to debug... read more  

We Might All Be AI Engineers Now
Link
@varbear shared a link, 2 weeks, 2 days ago
FAUN.dev()

Build agents that run automatically

Agents trigger from schedules, Slack, Linear, GitHub, PagerDuty events, or customwebhooks. They spin upcloud sandboxes. They run configuredMCPsand models. They verify outputs. They use amemorytool. Cursor automates security audits on pushes. Scores PR risk and auto-approves low-risk changes. Runs Pa.. read more  

Build agents that run automatically
Link
@varbear shared a link, 2 weeks, 2 days ago
FAUN.dev()

Zen: A Minimalist HTTP Library for Go

Unkey builtZen- a thin HTTP framework on Go'snet/http. It restores precise middleware ordering and lets middleware run after errors to capture the final response. Zen poolsSessionobjects to cut allocations. It emits RFC7807problem+jsonfor tagged domain errors. It runs OpenAPI validation before handl.. read more  

Zen: A Minimalist HTTP Library for Go
Link
@kaptain shared a link, 2 weeks, 2 days ago
FAUN.dev()

How Does Kubernetes Self-Healing Work? Understand Self-Healing By Breaking a Real Cluster

KubeLab boots a three-nodeKubernetescluster and runs seven failure simulations. It deploysNode.js,Postgres,Prometheus, andGrafana. Then it deletes pods, forcesOOMKill, throttles CPU, drains nodes, and scales aStatefulSetto zero. Each scenario surfaces fixes:readiness probes,PodDisruptionBudget, anti.. read more  

How Does Kubernetes Self-Healing Work? Understand Self-Healing By Breaking a Real Cluster
Link
@kaptain shared a link, 2 weeks, 2 days ago
FAUN.dev()

It's Not Kubernetes. It Never Was

The complexity in managing Kubernetes clusters is a reflection of the organizational decisions and lack of processes within the teams operating them. The move towards multi-cloud environments without sufficient planning or resources has exacerbated these issues. Platform engineering solutions offer .. read more  

It's Not Kubernetes. It Never Was
Link
@kaptain shared a link, 2 weeks, 2 days ago
FAUN.dev()

pg_plan_alternatives: Tracing PostgreSQL’s Query Plan Alternatives using eBPF

The tracer hooks PostgreSQL's optimizer via eBPF. It captures every alternative plan path with cost estimates and flags the chosen plan. A kernel-space eBPF program reads planner structs using DWARF-derived offsets. A user-space collector gathers the data and a visualizer renders plan graphs. eBPF p.. read more  

Link
@kaptain shared a link, 2 weeks, 2 days ago
FAUN.dev()

The great migration: Why every AI platform is converging on Kubernetes

The CNCF survey finds82%of container users runKubernetesin production.66%of GenAI hosts use it for inference. Kubernetes now stitches data processing, distributed training, LLM inference, and autonomous agents viaSpark,Kubeflow,Kueue,KServe, andArmada. GPU sharing and scheduling advanced withMIG, ti.. read more  

The great migration: Why every AI platform is converging on Kubernetes
Link
@kaptain shared a link, 2 weeks, 2 days ago
FAUN.dev()

How WebAssembly plugins simplify Kubernetes extensibility

Helm 4runsWebAssembly (Wasm)plugins to executeWASImodules insideOCIcontainers and VMs.Helmtemplates standardize module lifecycle. The Wasm plugin adds instruction-level sandboxing and Kubernetes segmentation.Helm 4preserves portability acrossx86/ARM. Compared withHelm 3plugins, it shows up to a 40% .. read more  

Link
@kala shared a link, 2 weeks, 2 days ago
FAUN.dev()

Reasoning models struggle to control their chains of thought, and that’s good

OpenAI's paper unveilsCoT-Control: an open-source suite of 13,000+ tasks fromGPQA, MMLU-Pro, HLE, BFCLthat measuresCoTcontrollability. Evaluations on 13 models show compliance at 0.1%-15.4%. Compliance is tiny. Controllability improves with model size. It drops as reasoning chains lengthen and after.. read more  

Reasoning models struggle to control their chains of thought, and that’s good
Link
@kala shared a link, 2 weeks, 2 days ago
FAUN.dev()

AI as tradecraft: How threat actors operationalize AI

Microsoft observes threat actors operationalizeAIandLLMsacross the cyberattack lifecycle. They accelerate reconnaissance, phishing, malware development, and post‑compromise triage. Actors abusejailbreakingtechniques andGANs. They craft personas, generate look‑alike domains, embed runtime‑adaptive pa.. read more  

AI as tradecraft: How threat actors operationalize AI
Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.