Updates and recent posts about Sigstore..

Posts
Description

Link

@faun shared a link, 11 months, 4 weeks ago

FAUN.dev()

Kubernetes at Google Cloud: AI, containers and open source scale

Kubernetestransformed from an obscure tech into a backbone for cloud-native AI projects. Today,Google Cloudtakes the crown for effortlessly scaling AI models withGKE. Together,Cloud RunandKubernetescurb AI inference expenses. The secret sauce? On-the-fly GPU access and serverless wizardry that let e.. read more

Link

@faun shared a link, 11 months, 4 weeks ago

FAUN.dev()

Open Source KubeVirt: VM Management With Kubernetes Is a Work in Progress

KubeVirtpromises the glitzy dream: running VMs in Kubernetes. With Red Hat and friends fanning the flame, it seems poised for greatness. But hold your applause—it's not yet a production powerhouse. Advanced VM management features? Missing in action. Switching to KubeVirt isn't just a hop; it's a lea.. read more

Link

@abc_01 shared a link, 11 months, 4 weeks ago

The Evolution of String Handling in Java: From Legacy to Lambdas

Hey, ever stopped to think about how Java handles all the text we throw at it every day? Well, get ready for a wild ride through the evolution of Java string handling! It’s a journey packed with performance secrets and clever tricks, I promise! 😉 Seriously, did you know a modern string can take upha.. read more

Story ManageEngine Team

@arshadmas shared a post, 11 months, 4 weeks ago

Product Marketer, manageengine

Challenges in synthetic monitoring

#synthet... #real us... #end use... #website... #digital...

Synthetic monitoring is a vital technique used to replicate user actions on a website or application in order to evaluate speed, availability, and functionality. It plays a crucial role in helping organizations maintain a seamless online presence and deliver a flawless user experience. However, desp..

Story

@laura_garcia shared a post, 1 year ago

Software Developer, RELIANOID

🚨 Critical Infrastructure Under Cyber Threat

Nova Scotia Power recently suffered a major data breach, impacting customer data and disrupting essential services like billing and online access for over half a million people. These attacks are not just IT issues — they're national resilience issues. At RELIANOID, we help utility providers and cri..

Link

@anjali shared a link, 1 year ago

Customer Marketing Manager, Last9

Windows Error Logs: Your Guide to Simplified Debugging

Windows error logs hold clues to what’s going wrong. Learn how to read them and make debugging faster and less frustrating.

Link

@anjali shared a link, 1 year ago

Customer Marketing Manager, Last9

Kubernetes Logs: How to Collect and Use Them

Understand how to collect, manage, and troubleshoot Kubernetes logs to keep your applications running smoothly and issues easy to debug.

Link

@anjali shared a link, 1 year ago

Customer Marketing Manager, Last9

Docker Container Lifecycle: Key States and Best Practices

Explore the key stages of the Docker container lifecycle and learn best practices to manage containers efficiently and reliably.

Story

@laura_garcia shared a post, 1 year ago

Software Developer, RELIANOID

🚀 BeDIGITAL 2025 – We’re heading to Bilbao! 🇪🇸

From June 3–5, RELIANOID will be at BeDIGITAL 2025, the key event for driving industrial digital transformation. 🔹 Live demos 🔹 Real-world use cases 🔹 Powerful networking 🔹 Part of +INDUSTRY, Spain’s biggest smart manufacturing showcase 📍 Let’s connect in Bilbao and explore how RELIANOID’s networkin..

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.