Updates and recent posts about Sigstore..

Posts
Description

Link

@devopslinks shared a link, 4 months ago

FAUN.dev()

async dns

A developer went digging for safer async DNS incurlafterpthread_cancelstarted breaking things. Threadless, callback-free options took the spotlight.OpenBSD’sasrquickly stood out, clean event loop integration, no threads, no drama. Beat outc-areson portability and design clarity... read more

News FAUN.dev() Team

@kaptain shared an update, 4 months ago

FAUN.dev()

Docker Brings Production-Grade Hardened Images to Developers at No Cost

#Complia... #Docker ... #supply-... #Securit... #docker

Docker has launched Docker Hardened Images, a secure and minimal set of production-ready images. These images are now freely available to developers.

Docker Brings Production-Grade Hardened Images to Developers at No Cost

Link

@anjali shared a link, 4 months ago

Customer Marketing Manager, Last9

OTel Updates: OpenTelemetry Deprecates Zipkin Exporters

OpenTelemetry deprecates Zipkin exporters in favor of native OTLP support. Migration paths and timeline through December 2026.

News FAUN.dev() Team

@kaptain shared an update, 4 months ago

FAUN.dev()

Argo CD 3.2.2 Improves Secret Management, Retry Safety, and Auth Checks

#Securit... #gitops #argocd #Argo CD #kuberne...

ArgoCD v3.2.2 has been released, featuring a new addition, two enhancements, and a bug fix. This update aims to improve the overall functionality and reliability of the platform.

Argo CD 3.2.2 Improves Secret Management, Retry Safety, and Auth Checks

News FAUN.dev() Team

@devopslinks shared an update, 4 months ago

FAUN.dev()

Rust Confirmed for Linux Kernel: Experiment Concludes Successfully

#Rust #linux #unix #Linux k... #The Rus...

The Rust experiment in the Linux kernel concludes, confirming its suitability and permanence in kernel development, with Rust now used in production and supported by major Linux distributions.

Rust Confirmed for Linux Kernel: Experiment Concludes Successfully

Course

@eon01 published a course, 4 months ago

Founder, FAUN.dev

Generative AI For The Rest Of US

#AI #Generat... #LLM #Large L... #gpt

Your Future, Decoded

News FAUN.dev() Team

@kaptain shared an update, 4 months ago

FAUN.dev()

Kubernetes v1.35 Timbernetes Release: 60 Enhancements

#k8s #Timbern... #cgroups #docker #kuberne...

Kubernetes v1.35, the Timbernetes Release, debuts with 60 enhancements, including stable in-place Pod updates and beta features for workload identity and certificate rotation.

Kubernetes v1.35 Timbernetes Release: 60 Enhancements

Activity

@kaptain added a new tool Kubernetes Gateway API , 4 months ago.

News FAUN.dev() Team

@kala shared an update, 4 months ago

FAUN.dev()

Google Releases Magika 1.0: AI File Detection in Rust

#Rust #Generat... #file ty... #Magika #AI

Google releases Magika 1.0, an AI file detection system rebuilt in Rust for improved performance and security.

Google Releases Magika 1.0: AI File Detection in Rust

Activity

@kala added a new tool Magika , 4 months ago.

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.