Join us

ContentUpdates and recent posts about Sigstore..
Link
@kaptain shared a link, 5 months, 3 weeks ago
FAUN.dev()

Azure Developer CLI: Azure Container Apps Dev-to-Prod Deployment with Layered Infrastructure

Azure Developer CLI v1.20.0 leveled up Container Apps. Build and push are now split from deploy, so you can finally "build once, deploy everywhere" and mean it. It adds layered infrastructure support, lets you share anAzure Container Registryacross environments, and handles resource dependency seque.. read more  

Azure Developer CLI: Azure Container Apps Dev-to-Prod Deployment with Layered Infrastructure
Link
@kala shared a link, 5 months, 3 weeks ago
FAUN.dev()

You Should Write An Agent

Building LLM agents - essentially looping stateless models through tools - looks simple. Until it isn't. Peel back the layers, and you hit real architectural puzzles:context engineering, agent loops, sub-agent choreography, execution constraints... read more  

You Should Write An Agent
Link
@kala shared a link, 5 months, 3 weeks ago
FAUN.dev()

How I Use Every Claude Code Feature

Claude Code isn't just generating responses anymore - it's gearing up to run projects. The new direction turns it into a programmable, auditable agent runtime. Think custom hooks, restart logic, planning workflows, GitHub Actions, and subagent delegation tricks like the “Master-Clone” pattern. At th.. read more  

How I Use Every Claude Code Feature
Link
@kala shared a link, 5 months, 3 weeks ago
FAUN.dev()

AI's Dial-Up Era

AI's reshaping jobs - but not evenly. Some industries will feel the squeeze faster than others. It all comes down to a race: productivity vs. demand. History's playbook? Think textiles, steel, autos. Automation boosted output. Jobs stuck around - as long as demand kept growing. Once markets topped o.. read more  

AI's Dial-Up Era
Link
@kala shared a link, 5 months, 3 weeks ago
FAUN.dev()

AI Broke Interviews

AI has revolutionized technical interviews, blurring the line between genuine skill and cheating with perfect solutions and polished answers. In response, companies are shifting back to in-person interviews for real-time cognitive transparency, authenticity constraints, realistic collaboration signa.. read more  

Link
@devopslinks shared a link, 5 months, 3 weeks ago
FAUN.dev()

Why I Like Using Docker Compose in Production

A decade in, and this dev still rides with Docker Compose for production. Why? It just works. Clean deployments, solid uptime, same setup everywhere. No yak-shaving. It shines when you pair it with Git hooks for hands-off, zero-downtime deploys. No need to drag in Kubernetes unless you’re actually w.. read more  

Why I Like Using Docker Compose in Production
Link
@devopslinks shared a link, 5 months, 3 weeks ago
FAUN.dev()

Perfetto: Swiss Army Knife for Linux Client Tracing

Perfetto now pulls in mixed trace data -perfsamples, scheduler events, app-level instrumentation - and lines it all up on a single timeline. One view, no silos. It readstrace-cmd’s text format now, with smoother flame graphs, sharper bottom-up views, and SQL-powered filtering baked right into the UI.. read more  

Perfetto: Swiss Army Knife for Linux Client Tracing
Link
@devopslinks shared a link, 5 months, 3 weeks ago
FAUN.dev()

VMware Cloud Foundation – what’s actually going on?

Broadcom underwent significant changes post-VMware acquisition, with emphasis on subscription-based pricing and portfolio simplification. Prashant Shenoy claims VCF lowered prices by 50%, challenging industry norms about AI workloads on bare metal versus virtualized environments. Integration pointed.. read more  

News FAUN.dev() Team
@kaptain shared an update, 5 months, 3 weeks ago
FAUN.dev()

Kubernetes Gateway API 1.4.0 Makes Network Routing More Declarative and Reliable

Istio Kubernetes

Kubernetes releases Gateway API 1.4.0, enhancing service networking with new features like secure TLS connections and improved configuration options.

Gateway API Logo
News FAUN.dev() Team
@kaptain shared an update, 5 months, 3 weeks ago
FAUN.dev()

Grafana Pushes the Limits of Metrics Performance with Mimir 3.0

Prometheus Grafana Mimir

Grafana Mimir 3.0 debuts with a new query engine and architecture, boosting performance, reliability, and cost efficiency.

Grafana Pushes the Limits of Metrics Performance with Mimir 3.0
Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.