Join us

ContentUpdates and recent posts about Sigstore..
Link
@faun shared a link, 11 months, 1 week ago
FAUN.dev()

Disrupting malicious uses of AI: June 2025

OpenAI's June 2025 report, "Disrupting Malicious Uses of AI," is out. It highlights various cases where AI tools were exploited for deceptive activities, including social engineering, cyber espionage, and influence operations... read more  

Disrupting malicious uses of AI: June 2025
Link
@faun shared a link, 11 months, 1 week ago
FAUN.dev()

God is hungry for Context: First thoughts on o3 pro

OpenAIjust took an axe too3pricing—down 80%. Entero3-prowith its $20/$80 show. They boast a star-studded 64% win rate against o3. Forget Opus;o3-pronails picking the right tools and reading the room, flipping task-specific LLM apps on their heads... read more  

God is hungry for Context: First thoughts on o3 pro
Link
@faun shared a link, 11 months, 1 week ago
FAUN.dev()

How we’re responding to The New York Times’ data demands in order to protect user privacy

OpenAI is challenging a court order stemming from The New York Times' copyright lawsuit, which mandates the indefinite retention of user data from ChatGPT and API services. OpenAI contends this requirement violates user privacy commitments and sets a concerning precedent. While the company complies .. read more  

How we’re responding to The New York Times’ data demands in order to protect user privacy
Link
@faun shared a link, 11 months, 1 week ago
FAUN.dev()

Meta Introduces LlamaRL: A Scalable PyTorch-Based Reinforcement Learning RL Framework for Efficient LLM Training at Scale

Reinforcement Learningfine-tunes large language models for better performance by adapting outputs based on structured feedback. Scaling RL for LLMs faces resource challenges due to massive computation, model sizes, and engineering problems like GPU idle time. Meta's LlamaRL is a PyTorch-based asynch.. read more  

Meta Introduces LlamaRL: A Scalable PyTorch-Based Reinforcement Learning RL Framework for Efficient LLM Training at Scale
Link
@faun shared a link, 11 months, 1 week ago
FAUN.dev()

Modern Test Automation with AI(LLM) and Playwright MCP (Model Context Protocol)

GenAI and Playwright MCP are shaking up test automation. Think natural language scripts and real-time adaptability, kicking flaky tests to the curb.But watch your step:security risks lurk, server juggling causes headaches, and dynamic UIs refuse to play nice... read more  

Link
@faun shared a link, 11 months, 1 week ago
FAUN.dev()

BenchmarkQED: Automated benchmarking of RAG systems

BenchmarkQEDtakes RAG benchmarking to another level. ImagineLazyGraphRAGsmashing through competition—even when wielding a hefty1M-tokencontext. The only hitch? It occasionally stumbles on direct relevance for local queries. But fear not,AutoQis in its corner, crafting a smorgasbord of synthetic quer.. read more  

Link
@faun shared a link, 11 months, 1 week ago
FAUN.dev()

The AI 4-Shot Testing Flow

4-Shot Testing Flowfuses AI's lightning-fast knack for spotting issues with the human knack for sniffing out those sneaky, context-heavy bugs. Trim QA time and expenses. While AI tears through broad test execution, human testers sharpen the lens, snagging false positives/negatives before they slip t.. read more  

The AI 4-Shot Testing Flow
Link
@faun shared a link, 11 months, 1 week ago
FAUN.dev()

Automate Models Training: An MLOps Pipeline with Tekton and Buildpacks

Tekton plusBuildpacks: your secret weapon for training GPT-2 without Dockerfile headaches. They wrap your code in containers, ensuring both security and performance.Tekton Pipelineslean on Kubernetes tasks to deliver isolation and reproducibility. Together, they transform CI/CD for ML into something.. read more  

Automate Models Training: An MLOps Pipeline with Tekton and Buildpacks
Link
@faun shared a link, 11 months, 1 week ago
FAUN.dev()

What execs want to know about multi-agentic systems with AI

Lack of resources kills agent teamwork in Multi-Agent Systems (MAS); clear roles and protocols rule the roost—plus a dash of rigorous testing and good AI behavior.Ignore bias, and your MAS could accidentally nudge e-commerce into the murky waters of socio-economic unfairness. Cue reputation hits and.. read more  

What execs want to know about multi-agentic systems with AI
Link
@faun shared a link, 11 months, 1 week ago
FAUN.dev()

GenAI Meets SLMs: A New Era for Edge Computing

SLMspower up edge computing with speed and privacy finesse. They master real-time decisions and steal the spotlight in cramped settings like telemedicine andsmart cities. On personal devices, they outdoLLMs—trimming the fat with model distillation and quantization. Equipped withONNXandMediaPipe, the.. read more  

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.