Updates and recent posts about Sigstore..

Posts
Description

Link

@faun shared a link, 10 months ago

FAUN.dev()

Cursor makes developers less effective?

METRtapped 16 devs to squash 136 live bugs withCursor(Sonnet 3.5/3.7). They clocked 146 h. AI users zipped through code, but stalls, reviews, and IDE lag devoured their lead. One dev who logged 50+ hours withCursorunlocked a 38% speedup. That steep learning curve and costly context pivots wipe out g.. read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

To be a better programmer, write little proofs in your head

Developer sketchesproofsmid-code. This drives first-run correctness by leaning onmonotonicity,immutability,invariants, andpre/postconditions. They carve code into atomic steps. They erectfirewallsto contain impact zones. They wield induction for recursive logic—proof-affinity blooms. They drill form.. read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

TODOs aren’t for doing

Teams balk at trackingTODOcomments. Some funnel them into bug trackers. Others prune stale tags. The post saysTODOs stash edge-case insights, not tickets... read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

Tencent’s AI-powered programming tool fully automates app development

Tencent’s AI team rolled out a 24-hour, invite-only beta of CodeBuddy to50,000 devs. CodeBuddy flips chat into code via itsconversation-is-programmingIDE. Devs forge end-to-end apps with natural language. Trend to watch:Chat-based IDEs portend a shift to natural-language dev workflows... read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

Amazon AI coding agent hacked to inject data wiping commands

A hacker slipped a wiper intoAmazon Qv1.84.0 via a dodgy GitHub pull. AWS revoked every key, nuked the rogue commit, then rolled outAmazon Q v1.85.0... read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

Alibaba Launches Qwen3-Coder AI Model for Agentic Programming Excellence

Alibaba unleashedQwen3-Coder, a480B-parameter MoE titan. It ignites35Bparameters per token to code, debug, and automate workflows. It spans256Ktokens of context—and can stretch to a million. It ships asQwen3-Coder-480B-A35B-Instructon Hugging Face and GitHub. It hooks intoQwen CodeCLI orClaude Code... read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

SQL Injection as a Feature

Over ten years, the legacy report page mutated from a locked-downSQLform. It ended up as a hidden console spilling raw database guts. Developers swapped hardcoded queries fordatabase-drivenreport names. They slapped ontimeouts,string filters, and warnings but skipped restoring safe defaults. Implic.. read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

I Watched Gemini CLI Hallucinate and Delete My Files

The Gemini CLI on Windows bungled a failedmkdir. It flagged the error as success, then ranmovecommands. Files landed in a ghost folder and got overwritten. Data vanished. WindowsmkdirsetsERRORLEVELon failure.movetreats missing targets as rename directives. No exit-code checks. No read-after-write ve.. read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

Secrets Management Tools: The Complete 2025 Guide

Pulumi ESC corrals secrets from 20 + stores—Vault, AWS, Azure, GCP—into a singleYAML config-as-codeengine. It spawns dynamic short-lived credentials and locks every action behind a centralized audit log. Existing secret stores stay intact. Retrieval hitssub-secondspeeds. Envelope encryption shields .. read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

OpenAI prepares to launch GPT-5 in August, The Verge reports

OpenAI set to launch GPT-5 in August, blending distinct models for versatile AI functionality. Watch for potential delays due to development hurdles or competitor announcements.Implication: OpenAI is shifting from "one model fits all" to a modular AI architecture. Expect future LLMs to act more like.. read more

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.