Join us

ContentUpdates and recent posts about Sigstore..
Link
@kaptain shared a link, 4 months ago
FAUN.dev()

Avoiding Zombie Cluster Members When Upgrading to etcd v3.6

etcd v3.5.26 patches a nasty upgrade bug. It now syncsv3storefromv2storeto stop zombie nodes from corrupting clusters during the jump to v3.6. The core issue: Older versions let stale store states bring removed members back from the dead... read more  

Link
@kaptain shared a link, 4 months ago
FAUN.dev()

Kubernetes OptimizationInPlace Pod Resizing,ZoneAware Routin

Halodoc cut EC2 costs and shaved latency by leaning into two Kubernetes tricks: In-place pod resizing(v1.33) lets them dial pod resources up or down on the fly, especially handy during off-peak hours. Zone-aware routingviatopology-aware hintskeeps inter-service traffic close to home (same AZ), skipp.. read more  

Kubernetes OptimizationInPlace Pod Resizing,ZoneAware Routin
Link
@kala shared a link, 4 months ago
FAUN.dev()

Review of Deep Seek OCR

DeepSeek-OCRflips the OCR script. Instead of feeding full image tokens to the decoder, it leans on an encoder to compress them up front, trimming down input size and GPU strain in one move. That context diet? It opens the door for way bigger windows in LLMs. Why it matters:Shoving compression earlie.. read more  

Link
@kala shared a link, 4 months ago
FAUN.dev()

Chinese AI in 2025, Wrapped

Chinese AI milestones in 2025: Big models from DeepSeek and others, AGI discussions at Alibaba, US-China chip war swings, Beijing's AI Action plan, and more. DeepSeek led the way with an open-source model, setting off a wave of Chinese companies going open-source. China's push for AGI and involvemen.. read more  

Link
@kala shared a link, 4 months ago
FAUN.dev()

Evaluating AI Agents in Security Operations

Cotool threw frontier LLMs at real-world SecOps tasks using Splunk’s BOTSv3 dataset.GPT-5topped the chart in accuracy (62.7%) and gave the best results per dollar.Claude Haiku-4.5blazed through tasks fastest, just 240 seconds on average, maxing out tool integrations.Gemini-2.5-proflopped on both acc.. read more  

Evaluating AI Agents in Security Operations
Link
@kala shared a link, 4 months ago
FAUN.dev()

Everything to know about Google Gemini’s most recent AI updates

Google jammed a full no-code AI workshop into Gemini. The browser now bakes inOpal, a drag-and-drop app builder with a shiny newvisual editor. You can chain prompts, preview apps, and feed it text, voice, or images, without touching code. They also dropped theGemini 3 Flash model, built for dual rea.. read more  

Link
@kala shared a link, 4 months ago
FAUN.dev()

AI agents are starting to eat SaaS

AI coding agents are eating the lunch of low-complexity SaaS. Teams with a bit of dev muscle are skipping subscription logins and spinning up dashboards, pipelines, even decks, using Claude, Gemini, whoever’s fastest that day. Build vs. buy? Tilting back toward build. The kicker: build now takes min.. read more  

AI agents are starting to eat SaaS
Link
@devopslinks shared a link, 4 months ago
FAUN.dev()

From Static Rate Limiting to Adaptive Traffic Management in Airbnb’s Key-Value Store

Airbnb just rewired Mussel, its key-value store, with a smarter, layered QoS system. Out go the rigid QPS caps. In comeresource-aware rate control,criticality-based load shedding, andreal-time hot-key mitigation. Dispatchers now speak the language of backend cost -rows, bytes, latency - not just raw.. read more  

From Static Rate Limiting to Adaptive Traffic Management in Airbnb’s Key-Value Store
Link
@devopslinks shared a link, 4 months ago
FAUN.dev()

Agent-Driven SRE Investigations: A Practical Deep Dive into Multi-Agent Incident Response

A sandboxed setup dropped multiple Claude-powered agents into Docker containers to run a full incident response drill. Each agent played a role: probing Kubernetes clusters, sniffing out root causes, and shipping remediation PRs straight to GitHub. Out of 7 test incidents, they nailed the diagnoses .. read more  

Agent-Driven SRE Investigations: A Practical Deep Dive into Multi-Agent Incident Response
Link
@devopslinks shared a link, 4 months ago
FAUN.dev()

How We Saved 70% of CPU and 60% of Memory in Refinery’s Go Code, No Rust Required.

Refinery 3.0 cuts CPU by 70% and slashes RAM by 60%. The trick: selective field extraction from serialized spans. No full deserialization. Fewer heap allocations. Way less waste. It also recycles buffers, handles metrics smarter, and is gearing up to parallelize its core decision loop... read more  

How We Saved 70% of CPU and 60% of Memory in Refinery’s Go Code, No Rust Required.
Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.