Join us

ContentUpdates and recent posts about Sigstore..
Link
@kala shared a link, 1 month, 4 weeks ago
FAUN.dev()

YOLO Mode: Hidden Risks in Claude Code Permissions

A scrape of 18,470 Claude Code configs on GitHub shows a pattern: developers are handing their AI agents the keys to the castle. Unrestricted file, shell, and network accessis common. Among them: - 21.3% let Claude runcurl - 14.5% allowarbitrary Python execution - 19.7% give itgit pushprivileges Tha.. read more  

YOLO Mode: Hidden Risks in Claude Code Permissions
Link
@kala shared a link, 1 month, 4 weeks ago
FAUN.dev()

Building a TUI is easy now

Hatchet usedClaude Code, a terminal-native coding agent, to build and ship a real TUI-based workflow manager - fast. Like, days-fast. Powered by theCharm stack(Bubble Tea, Lip Gloss, Huh), it leans hard into CLI-heavy development. Claude Code handled live testing intmux, whipped up frontend views fr.. read more  

Building a TUI is easy now
Link
@devopslinks shared a link, 1 month, 4 weeks ago
FAUN.dev()

Owning a $5M data center

Comma.ai just dropped the specs on its hand-rolled ML data center. Picture this: 600 homegrown GPU rigs (TinyBox Pros), 4PB of flash. The whole thing trains on a PyTorch stack they built themselves, wired up with a custom model tracker and job scheduler they namedMiniray. Inference runs through dyna.. read more  

Owning a $5M data center
Link
@devopslinks shared a link, 1 month, 4 weeks ago
FAUN.dev()

The future of software engineering is SRE

Agentic coding and no-code tools are everywhere now. Building features? Easier than ever. The harder part is keeping systems solid once they’re out in the wild. The real game:maintainability, reliability, and evolutionunder real pressure - not just building, but keeping it together over time... read more  

The future of software engineering is SRE
Link
@devopslinks shared a link, 1 month, 4 weeks ago
FAUN.dev()

From Paging to Postmortem: Google Cloud SREs on Using Gemini CLI for Outage Response

Google Cloud SREs just leveled up their incident response game with theGemini CLI- an LLM-fueled terminal sidekick built onGemini 3. It jumps in fast: drafts mitigation playbooks, digs into root causes, and cranks out postmortem reports. All withhuman-in-the-loopguardrails to keep things sane... read more  

From Paging to Postmortem: Google Cloud SREs on Using Gemini CLI for Outage Response
Link
@devopslinks shared a link, 1 month, 4 weeks ago
FAUN.dev()

Why does SSH send 100 packets per keystroke? ·

The default macOS SSH client now floods connections withSSH2_MSG_PING “chaff” packets- a 2023 privacy tweak meant to hide keystroke timing. Nice in theory. In practice? It tanks performance for real-time terminal apps like games built on Bubbletea over SSH. Turning it off - either through client fla.. read more  

Why does SSH send 100 packets per keystroke? ·
Link
@devopslinks shared a link, 1 month, 4 weeks ago
FAUN.dev()

GitHub Actions Is Slowly Killing Your Engineering Team

A seasoned CI engineer lays into GitHub Actions - too fragile, too fuzzy, too slow. Logs glitch. YAML confuses. Compute chokes. It solves for convenience, not power. Buildkitesteps in with stronger bones: reproducible runs, clean orchestration, and scalable agents you control... read more  

News FAUN.dev() Team
@kala shared an update, 1 month, 4 weeks ago
FAUN.dev()

GitHub Launches Copilot SDK to Embed Agentic AI into Any Application

GitHub Copilot GitHub Copilot SDK

GitHub has released the Copilot SDK in technical preview, allowing developers to embed Copilot’s agentic execution loop into their own applications. The SDK supports multiple AI models, real-time streaming, and languages like Python, TypeScript, Go, and .NET, but currently requires a Copilot subscription and is intended for development and testing rather than production use.

GitHub Launches Copilot SDK to Embed Agentic AI into Any Application
News FAUN.dev() Team
@varbear shared an update, 1 month, 4 weeks ago
FAUN.dev()

VillageSQL Launches: A Drop-In MySQL Fork Bringing Extensions and AI to the Core

VillageSQL MySQL

VillageSQL is a drop-in, open-source fork of MySQL that introduces a true extension framework, enabling permissionless innovation for AI-era workloads. It allows developers to add custom data types and functions - with vector indexing and search on the roadmap - bringing MySQL closer to PostgreSQL-style extensibility without waiting for core upstream changes.

 Activity
@kala added a new tool GitHub Copilot SDK , 1 month, 4 weeks ago.
Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.