Updates and recent posts about Sigstore..

Posts
Description

Link

@faun shared a link, 1 year ago

FAUN.dev()

v1.33: Updates to Container Lifecycle

Kubernetesv1.33just got a little smarter. Now you can use azero-duration Sleepaction in container lifecycle hooks. That means no more juggling extra binaries—nice and tidy. With alpha support, you get to tweak stop signals within containers. Forget those pesky image-level defaults. The catch? Your c.. read more

Link

@faun shared a link, 1 year ago

FAUN.dev()

Platform Engineering’s Role in Fixing Infrastructure Automation

Platform engineeringfuels DevOps with92% automated checks. It slashes infrastructure drift like crop circles in a hayfield. And83%strike gold with automated, self-serve platforms... read more

Link

@faun shared a link, 1 year ago

FAUN.dev()

v1.33: In-Place Pod Resize Graduated to Beta

Kubernetes v1.33hits the scene within-place Pod resize. Now, tweak CPU and memory settings without hitting restart. Perfect for keeping stateful apps sturdy. Expect faster scaling and smarter resource juggling. Plus, fancy new subresources and conditions polish up management and error reporting. In .. read more

Link

@faun shared a link, 1 year ago

FAUN.dev()

v1.33: Image Pull Policy the way you always thought it worked!

Kubernetes v1.33finally crushesIssue 18787. Now, every pod must authenticate before playing with already pulled private images. Security toughens without missing a beat. A fresh credential verification system zaps a decade-old loophole, slamming the door on unauthorized access... read more

Link

@faun shared a link, 1 year ago

FAUN.dev()

Announcing Native Azure Functions Support in Azure Container Apps

UnleashAzure FunctionsonAzure Container Appswith the fresh deployment model. Tap into the complete ACA toolkit—auto-scaling magic, no more juggling infrastructure. Transition turbocharges performance, smooths out deployment snags via CLI or Portal. Just set up with"kind=functionapp"and watch simplic.. read more

Link

@faun shared a link, 1 year ago

FAUN.dev()

1.33: Job's SuccessPolicy Goes GA

Kubernetes v1.33 just unleashedJob success policy GA. Now you can set your own victory conditions for Jobs, which will make life a whole lot easier for AI/ML andHPC workloads... read more

Link

@faun shared a link, 1 year ago

FAUN.dev()

Announcing etcd v3.6.0

etcd v3.6.0slashes its memory footprint by half, ditching v2store like yesterday's leftovers. Performance leaps by10%, powered by a string of clever tweaks. Kubernetes-style gates now govern upgrades; they promise to tame chaos but may demand a secret handshake... read more

Link

@faun shared a link, 1 year ago

FAUN.dev()

v1.33: Job's Backoff Limit Per Index Goes GA

Kubernetes v1.33just got a shiny new toy:Backoff Limit Per Index GA. Now, you can wrangle retries per job index like a pro. Say goodbye to those impatient failure-hungry beasts! 🎉.. read more

Link

@faun shared a link, 1 year ago

FAUN.dev()

How Kubernetes is Built

Kubernetessprang from Google'sBorglike a tech prodigy. It's a lesson in open-source wizardry, orchestrated by 150-200 zealous maintainers who roll out fresh updates every 14-16 weeks like clockwork. But here’s the magic trick: the "lead" and "shadow" setup. It’s a clever mentorship dance that lets r.. read more

Link

@faun shared a link, 1 year ago

FAUN.dev()

OrbStack: A Deep Dive for Container and Kubernetes Development

OrbStackrockets ahead with 2-5× faster I/O and harnesses Rosetta for blinding x86 speeds on Apple Silicon. For Mac users, it's a zippy Docker alternative. Unified Kubernetes, Linux machines, and effortless file sharing turbocharge development workflows. Meanwhile,Docker Desktopsulks in the corner, w.. read more

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.