Join us

ContentUpdates and recent posts about Sigstore..
Link
@anjali shared a link, 1 year, 2 months ago
Customer Marketing Manager, Last9

APM Observability: A Practical Guide for DevOps and SREs

A no-fluff guide to APM observability for DevOps and SREs—tools, tips, and what actually matters when keeping systems healthy.

application
Link
@anjali shared a link, 1 year, 2 months ago
Customer Marketing Manager, Last9

Getting Started with Prometheus Metrics Endpoints

Learn how to get started with Prometheus metrics endpoints to collect, expose, and query critical data for better system monitoring.

windows
Link
@anjali shared a link, 1 year, 2 months ago
Customer Marketing Manager, Last9

Database Monitoring Metrics: What to Track & Why It Matters

Not all database metrics are created equal. Learn which ones to track, why they matter, and how they help you stay ahead of performance issues.

CDN
Link
@faun shared a link, 1 year, 2 months ago
FAUN.dev()

Google Is Winning on Every AI Front

Google's Gemini 2.5 Probulldozes through benchmarks like LMArena and GPQA Diamond. With its gargantuan1 million token context windowand zero-cost access, it leavesOpenAIeating its dust. Google’s sprawling ecosystem welcomes Gemini with open arms. They're not just ruling AI text models; they command .. read more  

Google Is Winning on Every AI Front
Link
@faun shared a link, 1 year, 2 months ago
FAUN.dev()

AI code suggestions sabotage software supply chain

Look sharp!LLM-driven toolsare fabricating package names out of thin air. In commercial models, it's5.2%. For open models, a staggering21.7%. Ideal for those up to no good and into "slopsquatting.".. read more  

AI code suggestions sabotage software supply chain
Link
@faun shared a link, 1 year, 2 months ago
FAUN.dev()

Computer Use Agents (CUAs) for Enhanced Automation

Azure OpenAI Service's Responses APIhas rolled out theComputer Use Agent (CUA)—an AI that actually uses a computer like a human, and no, you're not dreaming. These CUAs harnessmultimodal visionand AI frameworks to navigate tasks with nimble reasoning. Forget your one-trick-pony RPAs; these guys brea.. read more  

Computer Use Agents (CUAs) for Enhanced Automation
Link
@faun shared a link, 1 year, 2 months ago
FAUN.dev()

Benchmarking a 65,000-node GKE cluster with AI workloads

GKE’s now flexes with a colossal 65,000-node cluster—a boon for AI workloads that feast on mega infrastructure. Building on their 50,000+ TPU cluster saga, GKE tackles AI workload quirks like resource juggling and node chatter. In CPU stress tests, they whipped up 65,000 StatefulSet Pods, flaunting .. read more  

Link
@faun shared a link, 1 year, 2 months ago
FAUN.dev()

Announcing the Agent2Agent Protocol (A2A)- Google Developers Blog

A2A Protocoltosses AI agents from different vendors into a communal sandbox. Over 50 tech behemoths likeGoogle, Salesforce, and PayPalrally behind it. Here, silos crumble. Built on solid tech standards, it lets agents dance through vibrant, multi-agent workflows. Think of it as a revolutionary leap .. read more  

Announcing the Agent2Agent Protocol (A2A)- Google Developers Blog
Link
@faun shared a link, 1 year, 2 months ago
FAUN.dev()

Building A Virtual Machine inside ChatGPT

ChatGPTmoonlights as a virtual Linux machine, performing calculations faster than some actual hardware. Impressive, right? But don't get too excited—it can't juggle real-time tasks or tap into a GPU. A digital superhero with a glaring Achilles' heel... read more  

Building A Virtual Machine inside ChatGPT
Link
@faun shared a link, 1 year, 2 months ago
FAUN.dev()

Anthropic scientists expose how AI actually ‘thinks’ — and discover it secretly plans ahead and sometimes lies

Anthropic develops new method to peer inside large language models like Claude, revealing advanced capabilities and internal processes. The research demonstrates models plan ahead, use similar blueprint for interpreting ideas across languages, and sometimes work backward from desired outcome. The ap.. read more  

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.