Updates and recent posts about Sigstore..

Posts
Description

Link

@faun shared a link, 10 months ago

FAUN.dev()

Building a Secure, Scalable, and Automated Cloud-Native Platform on AWS with EKS, GitOps, and…

The blueprint carves out production-grade AWS infra. Terraform orchestrates VPCs with public and private subnets, deploys a Bastion host, spins up private EKS clusters, and stands up an internet-facing ALB armed with SSL/TLS. Argo CD drives GitOps. The CI pipeline runs SAST, builds Docker images, hu.. read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

MCP Catalog: Finding the Right AI Tools for Your Project

Docker Desktop hatches a betaMCP CatalogandToolkit. It unleashes 100+ containerized Model Context Protocol servers loaded with metadata and use-case filters. Teams fire them via GUI or CLI. The catalog carvesDocker-builtimages from community builds, runs supply-chain scans, and seals isolation. Cust.. read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

We Added Chaos to Our CI/CD Pipelines — It Made Everything More Stable.

Wix’sMREteam injectsAI-drivenchaosintoCI/CDpipelines. Mobile releases gain speed and rock-solid stability. They harness hackathon-born prompt tests to bulletproof builds and deployments. Signal: AI resilience trials in pipelines mark a shift from rigid builds to probabilistic validation... read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

The Art of Azure RBAC for Kubernetes: A Complete Guide to Access Control Mastery

This article dives into Azure RBAC for Kubernetes. It maps each persona to pinpoint roles per namespace. Permissions stay minimal from the get-go. It ties role bindings toAzure AD groups, splits dev and prod, and flips on audit logs. Quarterly reviews, crisp docs keep RBAC lean and current... read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

Critical VMware Tools VGAuth Vulnerabilities Enable Full System Access for Attackers

Two CVE-2025 vulns in VMware Tools allow SYSTEM access via named pipe hijacking and path traversal. Upgrade to 12.5.1+ ASAP for fixes. Administrators must upgrade... read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

Serverless: The Illusion of Choice

A LinkedIn thread exposes a hack around AWS EventBridge’s256KBlimit. Someone chains Lambdas tocompressthendecompressevents. Serverless traps lurk: blown-upIAMpermissions. Triggers with zero validation. Wide-openegress. Unscanned packages fueling supply chain bombs... read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

GitHub Spark in public preview for Copilot Pro+ subscribers

GitHub Spark spins natural-language prompts into full-stack AI apps in minutes. It tapsClaude Sonnet 4to scaffold UI and server logic. It hooks updata storage,LLM inference, hosting,GitHub Actions,Dependabot, plus multi-LLM smarts from OpenAI, Meta, DeepSeek and xAI—zero config. Trend to watch: AI .. read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

A Mid-Year Look at CNCF Project Momentum

Cloud Native Computing Foundation’s mid-year report drops.Kubernetescommands 3,500+ authors.OpenTelemetryrockets to 1,884 contributors, snagging second in PR velocity.Backstageclimbs to 649.Argo(860) andFlux(156) lock GitOps in place.Kubeflowbreaks into the top 30 with 302. Trend to watch:Internal .. read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

Bare-Metal Kubernetes: The Performance Advantage Is Almost Gone

Benchmarks crack open the myth: VM-based Kubernetes rivals bare metal. It secures 99% throughput. It matches latency in netperf and MLPerf. Major clouds spin containers on VMs. They enforce hard resource caps, isolation, and central policy management. Bare metal shrinks to ultra-low-latency niches. .. read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

Kubernetes Image Builder Vulnerability Grants Root Access to Windows Nodes

A critical CVE-2025-7342 hauntsKubernetes Image Builder v0.1.44and earlier. It shipsNutanix/OVAimages with defaultWindows Administratorcreds intact. That slip-up invites root access on Windows nodes. Linux builds and other providers dodge this bullet. Mixed clusters run hot until images rebuild or p.. read more

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.