Join us

ContentUpdates and recent posts about Sigstore..
Link
@faun shared a link, 1 year ago
FAUN.dev()

Taking a Look at Database Disk, Memory, and Concurrency Management

Databasesdance between block and file-level access. They cleverly use memory like a magician with a hidden pocket, smoothing over sluggish disk interactions. Logs? They’re the secret sauce for slick crash recovery.Concurrency controlin the mad circus of transactions? Locks. They're the backstage cre.. read more  

Link
@faun shared a link, 1 year ago
FAUN.dev()

Ran out of infrastructure titles

Taloskicked k3s to the curb, quenching that nagging itch for declarative order that Nix left behind. For traffic control,Contourswooped in, bringing sanity to my DNS maze and giving Nginx the boot.VictoriaMetricsoutpaced Prometheus, delivering speed and thrift. It even does remote monitoring like a .. read more  

Link
@faun shared a link, 1 year ago
FAUN.dev()

JFrog’s Journey with AWS Graviton

JFrog’s leap toAWS Gravitonunleashed some wizardry: slashing compute costs by20%, slicing CPU usage by another20%, and shaving network latency by10%. But here’s the kicker—carbon footprint plummeted by60%. That’s efficiency with an eco-twist. They juggled feature flags and multi-architecture support.. read more  

JFrog’s Journey with AWS Graviton
Link
@faun shared a link, 1 year ago
FAUN.dev()

37signals on-prem migration to save millions, abandon AWS

37signalsplans to chop its cloud bill from a hefty$3.2Mto under$1Ma year by dumping AWS for its own gear, with some help from swift Dell and Pure Storage systems. Oh, andAWStossed in a $250K fee waiver to nudge that transition along... read more  

37signals on-prem migration to save millions, abandon AWS
Link
@faun shared a link, 1 year ago
FAUN.dev()

VMware perpetual license holders receive cease-and-desist letters from Broadcom

Broadcomis upending the game. After itsVMwareacquisition, they slashed perpetual licenses and cranked up subscription costs by a staggering300%. To top it off, they're firing off cease-and-desist letters to folks who’ve sworn off VMware. It’s like breaking up but still getting texts from your ex—awk.. read more  

VMware perpetual license holders receive cease-and-desist letters from Broadcom
Link
@faun shared a link, 1 year ago
FAUN.dev()

Google debuts an updated Gemini 2.5 Pro AI model ahead of I/O

Gemini 2.5 Pro Preview (I/O edition)is here, flexing its muscles in code editing and web app creation. This newcomer muscles its way to the top of theWebDev Arena Leaderboard. As if that wasn't enough, it scores a jaw-dropping84.8%on VideoMME for video analysis. And guess what? The price tag hasn’t .. read more  

Google debuts an updated Gemini 2.5 Pro AI model ahead of I/O
Link
@faun shared a link, 1 year ago
FAUN.dev()

Stop overbuilding evals

Over-engineering smothers momentum. Get it to prod yesterday. Imperfection? Own it. Tweak with real folks in the wild. Feature flags and sanity checks? Priceless. Theory's just noise until reality weighs in... read more  

Link
@faun shared a link, 1 year ago
FAUN.dev()

AI predicted the next pope. Did it get it right?

A.I. algorithm incorrectly predicted Italian Cardinal Parolin as next pope; new model analyzes voting trends and predicts U.S. Cardinal Prevost as a compromise candidate. Model may improve with inclusion of more political and geographical data, but current analysis offers insights into potential pap.. read more  

Link
@faun shared a link, 1 year ago
FAUN.dev()

Claude’s AI research mode now runs for up to 45 minutes before delivering reports

Anthropic's Claude just supercharged its Research feature, cranking out reports from hundreds of sources in a blazing 45 minutes.But stay sharp—AI has a knack for inventing phantom sources... read more  

Claude’s AI research mode now runs for up to 45 minutes before delivering reports
Link
@faun shared a link, 1 year ago
FAUN.dev()

Researchers Fine-Tune LLM for Reasoning with Only 1,000 Examples

Meet the"Wait" token trick—a clever nudge that sharpens a model's reasoning. It mirrors OpenAI's o1-preview magic using only 1,000 examples. And guess what? Not a speck of reinforcement learning in sight... read more  

Researchers Fine-Tune LLM for Reasoning with Only 1,000 Examples
Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.