Join us

ContentUpdates and recent posts about Sigstore..
Link
@varbear shared a link, 1 day, 1 hour ago
FAUN.dev()

Agentic Coding is a Trap

AI-driven coding agents are the hot new trend, but beware of the trade-offs: increased complexity, skills atrophy, vendor lock-in, and fluctuating costs. Only skilled developers can spot issues in the vast lines of generated code, but paradoxically, AI tools are impacting critical thinking skills ne.. read more  

Agentic Coding is a Trap
Link
@varbear shared a link, 1 day, 1 hour ago
FAUN.dev()

How We Reduced Median Memory Estimation Error by 99%, With the Help of AI

The compaction pipeline at Mixpanel ran into memory estimation issues causing OOMKills. By implementing AI-assisted analysis, they were able to reduce median estimation errorby 99%, leading to a significant improvement in memory estimation accuracy. Through thorough analysis and exploration of alter.. read more  

How We Reduced Median Memory Estimation Error by 99%, With the Help of AI
Link
@varbear shared a link, 1 day, 1 hour ago
FAUN.dev()

When upserts don't update but still write: Debugging Postgres performance at scale

The Datadog team introduced a new upsert query to track inactive hosts, but it unexpectedly increased disk writes and WAL syncs due to row locking. By digging into Postgres's Write-Ahead Logging (WAL) and rewriting the query using a Common Table Expression (CTE), they avoided unnecessary overhead an.. read more  

Link
@kaptain shared a link, 1 day, 1 hour ago
FAUN.dev()

From Ingress NGINX to Higress: migrating 60+ resources in 30 minutes with AI

With the March 2026 retirement ofIngress NGINX, teams face an urgent compliance mandate. They must replace unpatched controllers. EnterHigress. Built onEnvoyandIstio. It unifies LLM protocols, enforces token rate limits, caches prompts, hostsMCP, and usesxDSfor zero-downtime. AnAI agentpaired withhi.. read more  

From Ingress NGINX to Higress: migrating 60+ resources in 30 minutes with AI
Link
@kaptain shared a link, 1 day, 1 hour ago
FAUN.dev()

v1.36: Tiered Memory Protection with Memory QoS

Kubernetes v1.36 rolls out Memory QoS (alpha). Opt-inmemory reservation. Tiered protection by QoS class. Kubelet observability metrics. Kernel-version warnings. It separatesthrottlingfromreservation. A feature gate enables throttling. A kubelet config field controls tieredcgroup v2protection:Guarant.. read more  

Link
@kaptain shared a link, 1 day, 1 hour ago
FAUN.dev()

v1.36: In-Place Vertical Scaling for Pod-Level Resources Graduates to Beta

Kubernetes v1.36 moves In-Place Pod-Level Resources Vertical Scaling to Beta and flips the feature gate on by default. Operators can patch a Pod's aggregate resource to resize running Pods. Often no container restart is needed. Kubelet breaks the Pod-level change into per-container resize events. It.. read more  

Link
@kaptain shared a link, 1 day, 1 hour ago
FAUN.dev()

Auto-Diagnosing Kubernetes Alerts with HolmesGPT and CNCF Tools

STCLab built an AI investigation pipeline withHolmesGPT, a 200-linePythonplaybook, andOpenTelemetry. It streamedMimir,Loki, andTempointo Slack threads. Metadata-driven markdownrunbookslimited tools per namespace, cut wasted tool calls from 16 to 2, and let the same model resolve alerts faster... read more  

Auto-Diagnosing Kubernetes Alerts with HolmesGPT and CNCF Tools
Link
@kaptain shared a link, 1 day, 1 hour ago
FAUN.dev()

v1.36: Staleness Mitigation and Observability for Controllers

Kubernetes v1.36 shipsclient-goatomicFIFOprocessing and cache-introspection APIs. Controllers detect stale informer state and skip acting on it. kube-controller-managerenables the capability by default for four high-contention pod controllers. It addsalpha metricsfor skipped syncs and informer resou.. read more  

Link
@kala shared a link, 1 day, 2 hours ago
FAUN.dev()

An open-weights Chinese model just beat Claude, GPT-5.5, and Gemini in a programming challenge

The AI Coding Contest Day 12 matched ten models on a sliding‑letter puzzle. Open‑weightsKimi K2.6took first: 22 match points (7‑1‑0).MiMo V2‑Proscored second by blasting claims for intact ≥7‑letter seeds (43 points).GPT‑5.5andClaude Opus 4.7landed third and fifth. Grids ran10×10→30×30. Heavy scrambl.. read more  

An open-weights Chinese model just beat Claude, GPT-5.5, and Gemini in a programming challenge
Link
@kala shared a link, 1 day, 2 hours ago
FAUN.dev()

Monitoring LLM behavior: Drift, retries, and refusal patterns

Traditional software is predictable due to determinism, while generative AI is unpredictable. Engineers need a new infrastructure layer, the AI Evaluation Stack, to ship enterprise-ready AI products. The stack includes deterministic assertions and model-based assertions to ensure structural integrit.. read more  

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.