Updates and recent posts about Sigstore..

Posts
Description

Link

@faun shared a link, 1 year, 2 months ago

FAUN.dev()

Headlamp Project to Provide Graphical User Interface for Kubernetes

Microsoft'sHeadlamp—now part of theCNCF family—wants to shred Kubernetes' intimidating reputation. Think Windows, but for clusters. Their plan? Hook 10 million fresh recruits with their slickGUI. Here's the kicker: 61% of workloads already bow to Kubernetes, andAI/MLworkloads rule 56% of them. Who k.. read more

Link

@faun shared a link, 1 year, 2 months ago

FAUN.dev()

Mastering Complex Workloads with Kubernetes JobSet and GKE metrics

Kubernetesjust dropped a bombshell:JobSet. Managing tangled batch workloads? Now it's all a numbers game for the pros. Think of it as a maestro marshaling a wild orchestra of Jobs into harmony. But wait, there's more. From GKE 1.32.1 onward, they’ve slipped in automatic rollup metrics. No extra fees.. read more

Link

@faun shared a link, 1 year, 2 months ago

FAUN.dev()

Running Docker Containers on Kubernetes Without a Container Runtime Using WasmEdge

WasmEdgedoesn't just compete with old-school OCI runtimes—it obliterates them with lightning-fast startups. It takes a chainsaw to resource waste and security headaches, thanks to its ironclad sandboxing. Its cross-platform magic dances acrossx86, ARM, and RISC-Vwith zero configuration drama. A drea.. read more

Link

@faun shared a link, 1 year, 2 months ago

FAUN.dev()

Platformless: How Choreo Built a Secure Kubernetes Platform with GitOps

Choreo by WSO2dreams big, plotting to eclipse Kubernetes. It's not just any platform; it's anenterprise-grade Internal Developer Platformwrapped in an elegant UI. Think of it as a tech ballerina effortlessly twirling around more than 20 CNCF tools. The goal? Make code deployment child's play while b.. read more

Story

@viktoriiagolovtseva shared a post, 1 year, 2 months ago

How to Calculate Productivity in Jira: A Comprehensive Guide

Struggling to measure your team’s performance in Jira? Discover how to turn raw data into actionable productivity insights!

Link

@anjali shared a link, 1 year, 2 months ago

Customer Marketing Manager, Last9

The Role of Log Shippers in Your Stack

Log shippers quietly move logs to where they’re needed—making debugging, monitoring, and observability possible without the chaos.

Link

@anjali shared a link, 1 year, 2 months ago

Customer Marketing Manager, Last9

The Ultimate Guide to Ubuntu Performance Monitoring

A practical guide to monitoring performance on Ubuntu—tools, tips, and commands to keep your system running efficiently.

Link

@anjali shared a link, 1 year, 2 months ago

Customer Marketing Manager, Last9

API Latency: Definition, Measurement, and Optimization Techniques

Learn what API latency really means, how to measure it the right way, and practical ways to make your APIs respond faster.

Story

@laura_garcia shared a post, 1 year, 2 months ago

Software Developer, RELIANOID

🌐 Understanding the Five Eyes Coalition and Embracing Secure Innovation 🔒

The Five Eyes (FVEY) Coalition, an alliance of the US, UK, Canada, Australia, and New Zealand, has been a cornerstone of global intelligence sharing since WWII. Over the decades, its mission has evolved to address modern challenges like cybersecurity, critical infrastructure protection, and counteri..

The Five Eyes Coalition_ Origins, Evolution, and Principles of Secure Innovation Solutions

Story

@laura_garcia shared a post, 1 year, 2 months ago

Software Developer, RELIANOID

🚀 We’re heading to QCon London 2025! 🚀

From April 7th to 10th, RELIANOID will be joining some of the brightest minds in software development at QCon London, where pioneers and senior engineers share the latest trends, best practices, and real-world case studies. 🔹 What to Expect at QCon London? ✅ Emerging trends in software architecture,..

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.