Join us

ContentUpdates and recent posts about Sigstore..
Discovery IconThat's all about @Sigstore โ€” explore more posts below...
ย Activity
@sanjayjoshi gave ๐Ÿพ to How To Make a Fast Dynamic Language Interpreter , 2ย hours, 16ย minutes ago.
ย Activity
@sanjayjoshi gave ๐Ÿพ to A Couple Million Lines of Haskell: Production Engineering at Mercury , 2ย hours, 16ย minutes ago.
Story
@laura_garcia shared a post, 22ย hours ago
Software Developer, RELIANOID

๐—›๐—ฎ๐—ฐ๐—ธ ๐—ฆ๐—ฝ๐—ฎ๐—ฐ๐—ฒ ๐—–๐—ผ๐—ป ๐Ÿฎ๐Ÿฌ๐Ÿฎ๐Ÿฒ

๐Ÿš€ ๐—›๐—ฎ๐—ฐ๐—ธ ๐—ฆ๐—ฝ๐—ฎ๐—ฐ๐—ฒ ๐—–๐—ผ๐—ป ๐Ÿฎ๐Ÿฌ๐Ÿฎ๐Ÿฒ ๐Ÿ“ Kennedy Space Center ๐Ÿ“… May 6โ€“9, 2026 ๐™’๐™๐™š๐™ง๐™š ๐™˜๐™ฎ๐™—๐™š๐™ง๐™จ๐™š๐™˜๐™ช๐™ง๐™ž๐™ฉ๐™ฎ ๐™ข๐™š๐™š๐™ฉ๐™จ ๐™จ๐™ฅ๐™–๐™˜๐™š ๐™ž๐™ฃ๐™ฃ๐™ค๐™ซ๐™–๐™ฉ๐™ž๐™ค๐™ฃ. Hack Space Con is not your typical event โ€” itโ€™s where cybersecurity, aerospace, and advanced technologies converge to shape the future of security beyond Earth. ๐Ÿ” ๐—ช๐—ต๐—ฎ๐˜ ๐˜๐—ผ ๐—ฒ๐˜…๐—ฝ๐—ฒ๐—ฐ๐˜: - Hands-on techn..

HACKSPACECON2026_florida_RELIANOID
Link
@varbear shared a link, 23ย hours ago
FAUN.dev()

A Couple Million Lines of Haskell: Production Engineering at Mercury

Mercury runs ~2M lines ofHaskellin production. They choseTemporalto replace cron and DB-backed state machines. Durable workflows replace brittle coordination. They open-sourced aHaskellSDK forTemporal, wired inOpenTelemetryhooks, and pushed records-of-functions plus domain-error types... read more ย 

A Couple Million Lines of Haskell: Production Engineering at Mercury
Link
@varbear shared a link, 23ย hours ago
FAUN.dev()

How To Make a Fast Dynamic Language Interpreter

Zef's AST-walking interpreter posts a 16.6ร— speed-up. The gains come from surgical changes:64-bit tagged values,AST node & RMW specialization,symbol hash-consing,inline caches, and a shapedobject model. Developers built it onFil-C++and later ported it toYolo-C++. The Yolo build adds ~4x speed, at th.. read more ย 

Link
@varbear shared a link, 23ย hours ago
FAUN.dev()

Agentic Coding is a Trap

AI-driven coding agents are the hot new trend, but beware of the trade-offs: increased complexity, skills atrophy, vendor lock-in, and fluctuating costs. Only skilled developers can spot issues in the vast lines of generated code, but paradoxically, AI tools are impacting critical thinking skills ne.. read more ย 

Agentic Coding is a Trap
Link
@varbear shared a link, 23ย hours ago
FAUN.dev()

How We Reduced Median Memory Estimation Error by 99%, With the Help of AI

The compaction pipeline at Mixpanel ran into memory estimation issues causing OOMKills. By implementing AI-assisted analysis, they were able to reduce median estimation errorby 99%, leading to a significant improvement in memory estimation accuracy. Through thorough analysis and exploration of alter.. read more ย 

How We Reduced Median Memory Estimation Error by 99%, With the Help of AI
Link
@varbear shared a link, 23ย hours ago
FAUN.dev()

When upserts don't update but still write: Debugging Postgres performance at scale

The Datadog team introduced a new upsert query to track inactive hosts, but it unexpectedly increased disk writes and WAL syncs due to row locking. By digging into Postgres's Write-Ahead Logging (WAL) and rewriting the query using a Common Table Expression (CTE), they avoided unnecessary overhead an.. read more ย 

Link
@kaptain shared a link, 23ย hours ago
FAUN.dev()

From Ingress NGINX to Higress: migrating 60+ resources in 30 minutes with AI

With the March 2026 retirement ofIngress NGINX, teams face an urgent compliance mandate. They must replace unpatched controllers. EnterHigress. Built onEnvoyandIstio. It unifies LLM protocols, enforces token rate limits, caches prompts, hostsMCP, and usesxDSfor zero-downtime. AnAI agentpaired withhi.. read more ย 

From Ingress NGINX to Higress: migrating 60+ resources in 30 minutes with AI
Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.