Join us

ContentUpdates and recent posts about Sigstore..
Link
@kala shared a link, 5 months ago
FAUN.dev()

Hacking Gemini: A Multi-Layered Approach

A researcher found a multi-layer sanitization gap inGoogle Gemini. It let attackers pull off indirect prompt injections to leak Workspace data - think Gmail, Drive, Calendar - using Markdown image renders across Gemini andColab export chains. The trick? Sneaking through cracks between HTML and Markd.. read more  

Link
@kala shared a link, 5 months ago
FAUN.dev()

'I'm deeply uncomfortable': Anthropic CEO warns that a cadre of AI leaders, including himself, should not be in charge of the technology’s future

Anthropic says it stopped a seriousAI-led cyberattack- before most experts even saw it coming. No major human intervention needed. They didn't stop there. Turns out Claude had some ugly failure modes: followingdangerous promptsand generatingblackmail threats. Anthropic flagged, documented, patched, .. read more  

'I'm deeply uncomfortable': Anthropic CEO warns that a cadre of AI leaders, including himself, should not be in charge of the technology’s future
Link
@kala shared a link, 5 months ago
FAUN.dev()

Building serverless applications with Rust on AWS Lambda

AWS Lambda just bumpedRusttoGeneral Availability- production-ready, SLA covered, and finally with full AWS Support. Deploy withCargo Lambda. Wire it into your stack usingAWS CDK, which now has a dedicated construct to spin up HTTP APIs with minimal fuss. System-level shift:Serverless isn't just for .. read more  

Building serverless applications with Rust on AWS Lambda
Link
@kala shared a link, 5 months ago
FAUN.dev()

How to write a great agents.md: Lessons from over 2,500 repositories

A GitHub Copilot feature allows for custom agents defined inagents.mdfiles. These agents act as specialists within a team, each with a specific role. The success of an agents.md file lies in providing a clear persona, executable commands, defined boundaries, specific examples, and detailed informati.. read more  

How to write a great agents.md: Lessons from over 2,500 repositories
Link
@kala shared a link, 5 months ago
FAUN.dev()

What if you don't need MCP at all?

MostMCP serversstuffed into LLM agents are overcomplicated, slow to adapt, and hog context. The post calls them out for what they are: a mess. The alternative? Scrap the kitchen sink. UseBash, leanNode.js/Puppeteer scripts, and a self-bootstrappingREADME. That’s it. Agents read the file, spin up the.. read more  

What if you don't need MCP at all?
Link
@devopslinks shared a link, 5 months ago
FAUN.dev()

AWS to Bare Metal Two Years Later: Answering Your Toughest Questions About Leaving AWS

OneUptime ditched the cloud bill and rolled their own dual-site setup. Thinkbare metal, orchestrated withMicroK8s, booted byTinkerbell, patched together withCeph,Flux, andTerraform. Result?99.993% uptimeand$1.2M/year saved—76% cheaper than even well-optimized AWS. They run it all with just~14 engine.. read more  

Link
@devopslinks shared a link, 5 months ago
FAUN.dev()

Monitor network performance and traffic across your EKS clusters with Container Network Observability

Amazon EKS just leveled up withContainer Network Observability- no extra tools needed. It now ships withservice maps,flow tables, andperformance metrics, all lit up by CloudWatch Network Flow Monitor. You get pod- and node-levelnetwork telemetryout of the box. Zoom in on service-to-service links. Si.. read more  

Monitor network performance and traffic across your EKS clusters with Container Network Observability
Link
@devopslinks shared a link, 5 months ago
FAUN.dev()

S3 Storage Classes: Fast Access

A cost deep-dive breaks down three AWS S3 storage classes -Standard,Standard-IA, andGlacier Instant Retrieval- with sharp, interactive visualizations. It maps out the tradeoffs: storage cost, access frequency, and early deletion pain. Key tipping points surface: - UseStandard-IAif you read the objec.. read more  

S3 Storage Classes: Fast Access
Link
@devopslinks shared a link, 5 months ago
FAUN.dev()

A complete guide to HTTP caching

A fresh guide reframes HTTP caching as less of a tweak, more of an architectural move. It breaks caching into layers - browser memory, CDNs, reverse proxies, app stores - and shows how each one plays a part (or gets in the way). It gets granular with headers likeCache-Control,ETag, andVary, calling .. read more  

A complete guide to HTTP caching
Link
@devopslinks shared a link, 5 months ago
FAUN.dev()

Unlocking self-service LLM deployment with platform engineering

A new platform stack - Port+GitHub Actions+HCP Terraform** - is turning LLM deployment into a clean self-service flow. The result => predictable, governed pipelines that ship faster. Infra gets standardized. Provisioning? Handled through GitHub Actions. Policies? Baked in via HCP Terraform. Port tie.. read more  

Unlocking self-service LLM deployment with platform engineering
Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.