Join us

ContentUpdates and recent posts about Sigstore..
Story Palark Team Trending
@shurup shared a post, 2 weeks, 5 days ago
@palark

Kubernetes 1.35 new alpha features

Kubernetes

The next Kubernetes release, v1.35, is scheduled for December 17th. It should bring 15 new Alpha features, including the following ones: - Gang scheduling support - Mutable PersistentVolume node affinity - Restart all containers on container exits - Consider terminating Pods in Deployments - CSI vol..

Kubernetes v1.35 release
News FAUN.dev() Team Trending
@varbear shared an update, 2 weeks, 5 days ago
FAUN.dev()

NordPass: Worst Passwords of 2025 and How Each Generation Compares

NordPass's latest research reveals the ongoing global reliance on weak passwords like "123456" and "password," despite slight improvements in security practices.

NordPass: Worst Passwords of 2025 and How Each Generation Compares
News FAUN.dev() Team Trending
@kaptain shared an update, 2 weeks, 5 days ago
FAUN.dev()

Kubernetes v1.35: A Deep Dive Into the Biggest Changes Before the December 17 Release

Kubernetes containerd

Kubernetes v1.35 release removes cgroup v1 and containerd v1.X support, urging admins to migrate to newer versions and adopt enhancements like in-place Pod updates and OCI image volume support.

Kubernetes v1.35: A Deep Dive Into the Biggest Changes Before the December 17 Release
News FAUN.dev() Team Trending
@devopslinks shared an update, 2 weeks, 5 days ago
FAUN.dev()

Researcher Scans 5.6M GitLab Repositories, Uncovers 17,000 Live Secrets and a Decade of Exposed Credentials

Atlassian Bitbucket GitLab CI/CD GitLab AWS Lambda TruffleHog

A security research project led by Luke Marshall scanned 5.6 million GitLab repositories, uncovering over 17,000 live secrets and earning $9,000 in bounties, highlighting GitLab's larger scale and higher exposure risk compared to Bitbucket.

Researcher Scans 5.6M GitLab Repositories, Uncovers 17,000 Live Secrets and a Decade of Exposed Credentials
 Activity
@devopslinks added a new tool TruffleHog , 2 weeks, 5 days ago.
News FAUN.dev() Team Trending
@devopslinks shared an update, 2 weeks, 5 days ago
FAUN.dev()

AWS Optimizer Targets Unused NAT Gateways for Cost Savings

Amazon Web Services Amazon CloudWatch

AWS Compute Optimizer now helps identify unused NAT Gateways to boost cost savings by analyzing traffic activity and route table associations.

AWS Optimizer Targets Unused NAT Gateways for Cost Savings
News FAUN.dev() Team Trending
@devopslinks shared an update, 2 weeks, 5 days ago
FAUN.dev()

GitLab Uncovers Massive npm Attack - Developers on High Alert

Amazon Web Services GitLab GitHub npm

GitLab's team discovers a large-scale npm supply chain attack with malware that spreads through npm packages, threatening data destruction if disrupted.

GitLab Uncovers Massive npm Attack - Developers on High Alert
 Activity
@varbear added a new tool npm , 2 weeks, 5 days ago.
 Activity
@devopslinks added a new tool GitHub , 2 weeks, 5 days ago.
Story
@laura_garcia shared a post, 2 weeks, 5 days ago
Software Developer, RELIANOID

𝘐𝘯 𝘤𝘢𝘴𝘦 𝘺𝘰𝘶 𝘮𝘪𝘴𝘴𝘦𝘥 𝘪𝘵: Europe’s skies disrupted

Cyberattack on Collins Aerospace’s MUSE platform We shared this analysis a few months ago, but given the relevance of the topic and the growing impact of cyberattacks on critical infrastructure, it’s definitely worth resurfacing. The incident forced major airports like Heathrow, Brussels, and Berlin..

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.