Updates and recent posts about Sigstore..

Posts
Description

Link

@faun shared a link, 10 months ago

FAUN.dev()

The reality of GitOps application recreation

52%of teams believe they're ace at cloning apps from Git. High-performers?70%of them share in this delusion. Yet, lurking infrastructure wrinkles often deflate their grand plans. GitOps, that wild ride, inspires confidence. It dips, then soars. But just when enthusiasts think they're cruising, they .. read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

Server-Driven UI: Agile Interfaces Without App Releases

Server-driven UI (SDUI) shifts UI control to the server, allowing for instant, dynamic updates without app releases. JSON payloads define components, improving agility but requiring client-side rendering adjustments. Complex UI changes may still need app updates due to missing client-side components.. read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

A four day hiking trip into ScreenshotOne infrastructure to solve an issue

Misleading monitor alerts: Turns out, the villain wasexample.comblocking those pesky automated requests. No real service drama here. Just a wake-up call to tame those testing environments!.. read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

Use Terraform Modules in Pulumi Without Conversion

Pulumijust leveled up. It now runsTerraformmodules straight up. This means all that slick Pulumi magic paired with the Terraform groundwork you've already laid. Drop in a module, and Pulumi takes over execution and state management. Consider it your bridge to full Pulumi bliss... read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

AI-Powered Ransomware and Malware Detection in Cloud Environments

Cloud platforms face increasing ransomware and malware threats, leading to a shift towards AI and ML for advanced detection. Supervised models excel at known threats, while unsupervised methods detect novel attacks but generate more false positives. Deep learning is great for complex patterns but la.. read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

Stop Wasting Time: The Only Guide You’ll Ever Need to Setup/Fix SSH on EC2

GitHub's giving passwords the boot for HTTPS logins. Say hello topublic-key SSHor a Personal Access Token. So, load up those SSH keys—or hit the road... read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

AI is making developers faster, but at a cost

AI adoption edges code quality up by 3.4% and speeds up reviews by 3.1%, but beware—a 7.2% nosedive in delivery stability rears ugly security holes.Mask AI’s risky behavior with afortress-like infrastructure, a central vault for secrets,and a transparency upgrade to reclaim stability and nail compli.. read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

Debugging the One-in-a-Million Failure: Migrating Pinterest’s Search Infrastructure to Kubernetes

Migrating Pinterest's search infrastructure to Kubernetes—toasty, right? But it tripped over a rare hiccup: sluggish 5-second latencies. The culprit? cAdvisor, overzealously spying on memory like a helicopter parent. Flicking off WSS? Problem evaporated... read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

Wix Adds Chaos to CI/CD Pipelines with AI and Improves Reliability

Wixhas slipped probabilistic AI into the mix inCI/CD, and it doesn't clutter the works. This AI chews through build logs, shaving off hours from developer workloads. Migrating 100 modules took three months? Not anymore. They've sliced it to a mere 24-48 hours by marrying AI insights with their sharp.. read more

Link

@faun shared a link, 10 months ago

FAUN.dev()

Report - AI tools slow down experienced developers by 19%. A wake up call for industry hype?

Open-source devs got stuck, wasting 19% more time on tasks thanks to AI tools—oppose the hype and vendor bluster.Yet, a baffling 69% clung to AI, suggesting some sneaky perks lurk beneath the surface... read more

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.