Join us

ContentUpdates and recent posts about Sigstore..
Story Xygeni Team
@mashka shared a post, 6 months ago
Paid Acquisition and Growth Marketing, xygeni

Why Tool Sprawl Is Hurting AppSec More Than Helping It

Why Tool Sprawl Is Killing AppSec Productivity?

Modern engineering teams ship software faster than ever, but security tools haven’t kept up. Instead of helping, they often slow everything down. With multiple scanners, dashboards, and sources of truth, AppSec has become noisy and fragmented.

All in One Appsec Platforms
Story
@laura_garcia shared a post, 6 months ago
Software Developer, RELIANOID

Safeguarding Protected Health Information with RELIANOID 🛡️

RELIANOID aligns its organizational practices and Load Balancer platform with the HIPAA Security and Privacy Rule safeguards, ensuring the protection of electronic Protected Health Information (ePHI). ✅ Administrative, physical, and technical safeguards in place ✅ Encryption (TLS v1.2+, AES-256), RB..

HIPAA compliance RELIANOID
Link
@anjali shared a link, 6 months ago
Customer Marketing Manager, Last9

OTel Updates: Consistent Probability Sampling Fixes Fragmented Traces

One sampling decision, propagated everywhere. OpenTelemetry's Consistent Probability Sampling fixes fragmented traces across services.

consistent_sampling
Story
@laura_garcia shared a post, 6 months ago
Software Developer, RELIANOID

🚀 RELIANOID at DevOpsDays Istanbul 2025 – Building the Future of DevOps Together

🗓 November 1st, 2025 | 📍 Istanbul, Türkiye The DevOps world never stops evolving — and DevOpsDays Istanbul 2025 is where innovation, collaboration, and continuous improvement meet. Join RELIANOID and the global DevOps community to explore: 🔹 Continuous Delivery & Automation – Streamlining pipelines ..

devopsdays Istanbul relianoid
Link
@varbear shared a link, 6 months ago
FAUN.dev()

Build Your Own Database

LSM trees fix the mess naive key-value stores run into. They blendin-memory sorted indexeswithappend-only disk filesto keep things snappy. Writes get logged, not scattered. Reads stay fast. When files pile up,compaction and segmentingkick in to keep storage lean. This is a rewrite of the storage pla.. read more  

Build Your Own Database
Link
@varbear shared a link, 6 months ago
FAUN.dev()

100X Faster: How We Supercharged Netflix Maestro’s Workflow Engine

The Maestro engine has been revamped for jaw-dropping improvement: a speed boost of100Xwith overhead slashed from seconds to milliseconds. The groundbreaking redesign delivers massive performance gains, solving past workflow development hurdles and elevating user experiences sky-high!.. read more  

Link
@varbear shared a link, 6 months ago
FAUN.dev()

How I Reversed Amazon's Kindle Web Obfuscation Because Their App Sucked

A developer cracked Kindle Cloud Reader’s font obfuscation, sidestepping randomized glyph swaps withSVG renderingandSSIM-powered perceptual hashingto rebuild actual EPUBs. Amazon rotates font mappings every five pages, using finicky micro-paths to jam scrapers and derail OCR. It wasn’t enough. Syste.. read more  

How I Reversed Amazon's Kindle Web Obfuscation Because Their App Sucked
Link
@varbear shared a link, 6 months ago
FAUN.dev()

Measuring Engineering Productivity

A former engineering leader lays out a no-nonsense framework for tracking team output without turning into Big Brother. Think:daily Slack updates,weekly GitHub changelogs,tight 1:1s,demo-fueled All-Hands, andauto-verified deploys. It leans onpublic artifacts, not peeking over shoulders - and puts th.. read more  

Measuring Engineering Productivity
Link
@varbear shared a link, 6 months ago
FAUN.dev()

State of AI Report 2025

The 2025 State of AI Report just landed—China’s catching up fast on reasoning and coding. Models like DeepSeek, Qwen, and Kimi are starting to nip at OpenAI’s heels. AI is thinking longer-term now. Reinforced reasoning and rubric-style feedback are pushing models into deeper, more deliberate plannin.. read more  

State of AI Report 2025
Link
@varbear shared a link, 6 months ago
FAUN.dev()

Discussion of the Benefits and Drawbacks of the Git Pre-Commit Hook

Pre-commit hooks catch secrets and fix formatting before bad stuff hits your repo. But if they’re clunky or slow, devs bail. Tools likePre-Commit,Husky, anddevenvare trying to fix that.devenvstands out—hooks are baked right into your Nix env, no extra glue scripts... read more  

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.