Learn Git in a Day
Everything you need, nothing you don't
Updates and recent posts about Sigstore..
That's all about @Sigstore — explore more posts below... Course
@eon01 published a course, 3 hours ago
Founder, FAUN.dev
Activity
@shurup gave 🐾 to Helm Cheat Sheet: Everything You Need to Know to Start Using Helm , 3 days, 2 hours ago.
Story Palark Team Trending
@shurup shared a post, 3 days, 2 hours ago
@palark
Kubernetes best practices for DevOps engineers
Have to manage Kubernetes in production but don’t feel confident about its many moving parts, complex architecture, and configurations? Here’s a selection of technical guides from experienced engineers for Kubernetes beginners looking to master this orchestration tool for running containerised apps efficiently and reliably.
Link
@pramod_kumar_0820 shared a link, 3 days, 8 hours ago
Software Engineer, Teknospire
⚡ Why Your Spring Boot API Takes 3 Seconds to Respond (And How to Fix It)
A practical breakdown of the most common Spring Boot performance bottlenecks — and how we optimized our API from 3 seconds to 200 ms.
News FAUN.dev() Team Trending
@devopslinks shared an update, 3 days, 11 hours ago
FAUN.dev()
Microsoft Project Silica: Your Data, Stored in a Pyrex Dish, for 10,000 Years
Microsoft's Project Silica encodes data in borosilicate glass using femtosecond lasers, offering long-term storage for up to 10,000 years. This method overcomes traditional storage limitations and is cost-effective, though write speed remains a challenge. The research phase is complete, but no product release has been announced.
News FAUN.dev() Team Trending
@varbear shared an update, 3 days, 21 hours ago
FAUN.dev()
Operating Systems as Age Gatekeepers: The Law That Could Reshape the Internet
California's Digital Age Assurance Act mandates operating systems to share users' age data with app developers via a real-time API by 2027. The law faces criticism for depending on self-reported ages, potentially affecting its efficacy.
Link
@varbear shared a link, 5 days, 6 hours ago
FAUN.dev()
The Great Developer Divide: How AI Is Reshaping the Software Job Market Into Three Tiers
AI hiring has split dev work into three camps:Apex Tier,Hybrid Middle, and a shrinkingAutomatable Tail. Demand now favorsAI orchestration,prompt engineering, fastcode reading, and platform roles likeplatform engineer,fleet supervisor, andAI QA. System shift:Organizations must rework career ladders, .. read more
Link
@varbear shared a link, 5 days, 6 hours ago
FAUN.dev()
I deleted my laptop from my dev workflow. My iPhone does the job now
A developer ditches the laptop and SSHs from an iPhone into an always-onMac Mini. The phone becomes a terminal and browser. The remote runs the dev server, theClaude Code/CodexCLI, hot reload, file watching, and pushes viaTailscale. Persistent sessions (tmux) keep AI agents and services alive across.. read more
Link
@varbear shared a link, 5 days, 6 hours ago
FAUN.dev()
We Might All Be AI Engineers Now
The author supervises AI agents that orchestrate concurrent graph traversal, multi-layer hashing, AST parsing, and file system watchers. The agents run traversal, hashing, and watcher loops. The engineer architects system behavior, verifies outputs, and probes agents in parallel to debug... read more
Link
@varbear shared a link, 5 days, 6 hours ago
FAUN.dev()
Build agents that run automatically
Agents trigger from schedules, Slack, Linear, GitHub, PagerDuty events, or customwebhooks. They spin upcloud sandboxes. They run configuredMCPsand models. They verify outputs. They use amemorytool. Cursor automates security audits on pushes. Scores PR risk and auto-approves low-risk changes. Runs Pa.. read more
At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.
The sigstore ecosystem is composed of several key components:
- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.
- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.
- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.
Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).
sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.
The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.
