Join us

ContentUpdates and recent posts about Sigstore..
Link
@faun shared a link, 11 months, 4 weeks ago
FAUN.dev()

Optimizing Cost Management: Leveraging Resource Tagging and Mondoo Policies

Mondootags resources like a masterful librarian labels books. Then, it deploys custom policies that automate compliance like clockwork. Governance becomes a seamless dance, and cloud operations? They sprint faster than Usain Bolt... read more  

Link
@faun shared a link, 11 months, 4 weeks ago
FAUN.dev()

X (Twitter) was down — what happened during major outage that stretched into weekend

Xis still on the struggle bus. DMs? Still glitching, after a full day of chaos. Rumor has it, a fire at an Oregon data center might be the culprit. Oh, and two-factor authentication? Down for the count too... read more  

X (Twitter) was down — what happened during major outage that stretched into weekend
Link
@faun shared a link, 11 months, 4 weeks ago
FAUN.dev()

Mountpoint for Amazon S3 now lets you automatically mount your S3 buckets using fstab

Mountpoint for Amazon S3now cracks the fstab problem. It auto-mounts S3 buckets when an EC2 instance comes online, securing those settings even after a reboot. Consider the convenience nailed... read more  

Mountpoint for Amazon S3 now lets you automatically mount your S3 buckets using fstab
Link
@faun shared a link, 11 months, 4 weeks ago
FAUN.dev()

How To Start Strong In Your First Week As An Engineering Manager

The first week as an engineering manager (EM) involves preparing for meetings with the team, other managers, and supervisors, as well as talking to one's own manager to understand expectations and priorities. It's crucial to reintroduce oneself to the team, even if promoted from within the company, .. read more  

How To Start Strong In Your First Week As An Engineering Manager
Link
@faun shared a link, 11 months, 4 weeks ago
FAUN.dev()

The Windows Subsystem for Linux is now open source

The Windows Subsystem for Linux (WSL) has been open-sourced, with its code now available on GitHub at Microsoft/WSL. WSL is made up of distribution components that run both within Windows and inside the WSL 2 virtual machine. This open-source release is part of the evolution of WSL, which has seen s.. read more  

Link
@faun shared a link, 11 months, 4 weeks ago
FAUN.dev()

Google Study: 65% of Developer Time Wasted Without Platforms

Platform engineering rescues 65% of developer time usually tossed to the wind, activating productivity and shrinking expenses.No shocker,86% call it key to unlocking AI's potential, while a brisk71% of leaders sprint to market faster.Going it solo? Hardly—96% harness open source tools and 84% team u.. read more  

Google Study: 65% of Developer Time Wasted Without Platforms
Link
@faun shared a link, 11 months, 4 weeks ago
FAUN.dev()

Improving EC2 boot time from 4s to 2.8s to accelerate builds

Revving upUbuntu 24.04for a speedier boot, we ditched dead weight likesnaps, AppArmor, andcloud-init—trimminguserspace boottime from 4 to2.8 seconds. BanishingIPv6address checks and pruningsystemdservices likejournaldshaved off more precious milliseconds. Next on the chopping block: kernel modules a.. read more  

Improving EC2 boot time from 4s to 2.8s to accelerate builds
Link
@faun shared a link, 11 months, 4 weeks ago
FAUN.dev()

DR 101: Assembling Your Incident Response Team

A disaster recovery plan relies on a coordinated incident response team. The speed and coordination of this team are crucial for minimizing downtime and keeping the organization running smoothly during a crisis. Key roles within the incident response team include incident commander, technical lead, .. read more  

Link
@faun shared a link, 11 months, 4 weeks ago
FAUN.dev()

Building Azure Right: A Practical Checklist for Infrastructure Landing Zones

Azure fans are pros at dodging groundwork, which, surprise, leads to chaos; lay down a rock-solid Landing Zone to hack your costs and cut the pandemonium.GrabInfrastructure as Code tools like Terraformto smooth out deployments. Make sureRBACdoesn’t dive into the horror of unmonitored access... read more  

Building Azure Right: A Practical Checklist for Infrastructure Landing Zones
Link
@faun shared a link, 11 months, 4 weeks ago
FAUN.dev()

Scaling Azure Microservices for Holiday Peak Traffic

Automation hacks away scaling migrainesfor microservices drowning in peak traffic. WithAzure DevOps CI/CDpipelines andIaC, scaling morphs into a cost-effective breeze. JustCosmos DB autoscalingcan shave off up to$7,200a year. Automation’s the unsung hero of cloud efficiency—no capes needed... read more  

Scaling Azure Microservices for Holiday Peak Traffic
Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.