Join us

ContentUpdates and recent posts about Sigstore..
Link
@anjali shared a link, 10 months, 2 weeks ago
Customer Marketing Manager, Last9

Instrument LangChain and LangGraph Apps with OpenTelemetry

Understand how to trace, monitor, and debug LangChain and LangGraph apps using OpenTelemetry, down to chains, tools, tokens, and state flows.

LangChain & LangGraph
Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

I’m Losing All Trust in the AI Industry

AI bigwigs promiseAGIin a quick 1-5 years, but the revolving door at labs like OpenAI screams wishful thinking. As AI hustles to serve up habit-forming products, the priority on user engagement echoes the well-troddensocial mediaplaybook. Who needs productivity, anyway? Cash fuels AI's joyride, with.. read more  

I’m Losing All Trust in the AI Industry
Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

EU businesses push for freedom from AI rules and competition

Mistral's"AI for Citizens" isn't just about tech; it's about shaking up public services for the better. Meanwhile, in the EU, a plot twist—50 European firms holler for halting the AI Act, all in the name of staying competitive. They argue speed matters more than red tape. But hey, watchdogs eye them.. read more  

EU businesses push for freedom from AI rules and competition
Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

Gemma 3n Introduces Novel Techniques for Enhanced Mobile AI Inference

Gemma 3nshakes up mobile AI with a two-punch combo:Per-Layer Embeddingsthat axe RAM usage andMatFormerthat sends performance into overdrive with elastic inference and nesting.KV cache sharingcranks up the speed of streaming responses, though it taps out at multilingual audio processing for clips up .. read more  

Gemma 3n Introduces Novel Techniques for Enhanced Mobile AI Inference
Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

From Noise to Structure: Building a Flow Matching Model from Scratch

Train a petite neural net to align velocity flows between distributions. DeployFlow Matching lossfor the job. Harness the precision of theAdamoptimizer to keep it sharp... read more  

From Noise to Structure: Building a Flow Matching Model from Scratch
Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

Massive study detects AI fingerprints in millions of scientific papers

Study finds 13.5% of 2024 PubMed papers bear LLM fingerprints, showcasing a shift to jazzy "stylistic" verbs over stodgy nouns.Upending stuffy academic norms!.. read more  

Massive study detects AI fingerprints in millions of scientific papers
Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

MCP — The Missing Link Between AI Models and Your Applications

Model Context Protocol (MCP)tackles the "MxN problem" in AI by creating a universal handshake for tool interactions. It simplifies howLLMstap into external resources. MCP leans onJSON-RPC 2.0for streamlined dialogues, building modular, maintainable, and secure ecosystems that boast reusable and inte.. read more  

MCP — The Missing Link Between AI Models and Your Applications
Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

Building “Auto-Analyst” — A data analytics AI agentic system

DSPyfuels a modular AI machine, drivingagent chainsto weave tidy analysis scripts. But it’s not all sunshine and roses—hallucination errors like to throw reliability under the bus... read more  

Building “Auto-Analyst” — A data analytics AI agentic system
Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

Automatically Evaluating AI Coding Assistants with Each Git Commit ¡ TensorZero

TensorZerotransforms developer lives by nabbing feedback fromCursor'sLLM inferences. It dives into the details withtree edit distance (TED)to dissect code. Over in a different corner,Claude 3.7 SonnetschoolsGPT-4.1when it comes to personalized coding. Who knew? Not all AI flexes equally... read more  

Automatically Evaluating AI Coding Assistants with Each Git Commit ¡ TensorZero
Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

Document Search with NLP: What Actually Works (and Why)

NLP document search trounces old-school keyword hunting. It taps into scalable*vector databasesandsemantic vectorsto grasp meaning, not just parrot words.* Pictureword vector arithmetic: "King - Man + Woman = Queen." It's magic. Searches become lightning-fast and drenched in context... read more  

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.