Join us

ContentUpdates and recent posts about Sigstore..
Link
@varbear shared a link, 6 months ago
FAUN.dev()

Aggressive bots ruined my weekend

Bear Blog went dark after getting swarmed by scrapers. The reverse proxy choked first - too many requests, not enough heads-up. Downstream defenses didn’t catch it in time. So: fire, meet upgrades. What changed: Proxies scaled 5×. Upstream got strict with rate limits. Failover now has a pulse. Resta.. read more  

Link
@varbear shared a link, 6 months ago
FAUN.dev()

The bug that taught me more about PyTorch than years of using it

A sneaky bug inPyTorch’s MPS backendlet non-contiguous tensors silently ignore in-place ops likeaddcmul_. That’s optimizer-breaking stuff. The culprit? ThePlaceholder abstraction- meant to handle temp buffers under the hood - forgot to actually write results back to the original tensor... read more  

The bug that taught me more about PyTorch than years of using it
Link
@varbear shared a link, 6 months ago
FAUN.dev()

uv is the best thing to happen to the Python ecosystem in a decade

uvis a new Rust-powered CLI from Astral that tosses Python versioning, virtualenvs, and dependency syncing into one blisteringly fast tool. It handles yourpyproject.tomllike a grown-up—auto-generates it, updates it, keeps your environments identical across machines. Need to run a tool once without t.. read more  

uv is the best thing to happen to the Python ecosystem in a decade
Link
@varbear shared a link, 6 months ago
FAUN.dev()

Kafka is fast -- I'll use Postgres

Postgres is pulling Kafka moves—without the Kafka. On a humble 3-node cluster, it held 5MB/s ingest and 25MB/s egress like a champ. Low latency. Rock-solid durability. Crank things up, andsingle-node Postgresflexed hard: 240 MiB/s in, 1.16 GiB/s out for pub/sub. Thousands of messages per second in q.. read more  

Kafka is fast -- I'll use Postgres
Link
@varbear shared a link, 6 months ago
FAUN.dev()

How Netflix Tudum Supports 20 Million Users With CQRS

Netflix gutted Tudum’s old read path—Kafka, Cassandra, layers of cache—and swapped inRAW Hollow, a compressed, distributed, in-memory object store baked right into each microservice. Result? Homepage renders dropped from 1.4s to 0.4s. Editors get near-instant previews. No more read caches. No extern.. read more  

How Netflix Tudum Supports 20 Million Users With CQRS
Link
@kaptain shared a link, 6 months ago
FAUN.dev()

eBPF Beginner Skill Path

This hands-on path drops devs straight into writing, loading, and poking at basiceBPFprograms withlibbpf,maps, and those all-important kernel safety checks. It starts simple - with a beginner-friendly challenge - then dives deeper into theverifierand tools for runtime introspection... read more  

eBPF Beginner Skill Path
Link
@kaptain shared a link, 6 months ago
FAUN.dev()

How to build highly available Kubernetes applications with Amazon EKS Auto Mode

Amazon EKS Auto Mode now runs the cluster for you—handling control plane updates, add-on management, and node rotation. It sticks to Kubernetes best practices so your apps stay up through node drains, pod failures, AZ outages, and rolling upgrades. It also respectsPod Disruption Budgets,Readiness Ga.. read more  

How to build highly available Kubernetes applications with Amazon EKS Auto Mode
Link
@kaptain shared a link, 6 months ago
FAUN.dev()

Building a Kubernetes Platform — Think Big, Think in Planes

Thinking in planes, as introduced by the Platform Engineering reference model, helps teams describe their platform in a simple, shared language, turning a collection of tools into a platform. It forces you to think horizontally, connecting teams and technologies instead of adding more layers, creati.. read more  

Link
@kaptain shared a link, 6 months ago
FAUN.dev()

Helm 4 Overview

Helm 4 ditches the old plugin model for a sharper, plugin-first architecture powered by WebAssembly. That means isolation/control, and deeper customization - if you're ready to adapt! Post-renderers are now plugins. That breaks compatibility with earlier exec-based setups, so expect some rewiring. .. read more  

Link
@kaptain shared a link, 6 months ago
FAUN.dev()

The State of OCI Artifacts for AI/ML

OCI artifacts quietly leveled up. Over the last 18 months, they’ve gone from a niche hack to production muscle for AI/ML workloads on Kubernetes. The signs? Clear enough:KitOpsandModelPacklanded in the CNCF Sandbox. Kubernetes 1.31 got native support forImage Volume Source. Docker pushedModel Runner.. read more  

The State of OCI Artifacts for AI/ML
Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.