Join us

ContentUpdates and recent posts about Sigstore..
Link
@kaptain shared a link, 1 month ago
FAUN.dev()

v1.35: Mutable PersistentVolume Node Affinity (alpha)

Kubernetes 1.35 (alpha) cracks openPersistentVolume node affinity. You can now update it on the fly. Before, it was locked down - once set, it stayed set. That got in the way of shifting workloads when disks were upgraded or moved across zones. Now? More flexibility. Less pain... read more  

Link
@kala shared a link, 1 month ago
FAUN.dev()

How to build a Frontend for LangChain Deep Agents with CopilotKit!

LangChain recently introduced Deep Agents: a new way to build structured, multi-agent systems that can plan, delegate, and reason across multiple steps. It comes with built-in planning, a filesystem for context, and subagent spawning. But connecting that agent to a real frontend is still surprisingl.. read more  

Link
@kala shared a link, 1 month ago
FAUN.dev()

How to Train an AI Agent for Command-Line Tasks with Synthetic Data and Reinforcement Learning

NVIDIA shows how to fine-tuneNemotron-Nano-9B-V2to handle new CLI tools - without touching real user data. The trick? A mix ofsynthetic data,reinforcement learning with verifiable rewards (RLVR), and their home-grown trainer stack:NeMo GymplusGRPO. The result: an LLM agent that adapts fast, plays ni.. read more  

How to Train an AI Agent for Command-Line Tasks with Synthetic Data and Reinforcement Learning
Link
@kala shared a link, 1 month ago
FAUN.dev()

The Rise of GPUOps: Where Infrastructure Meets Thermodynamics

GPU demand for AI has shot up 600% since 2020. It’s outpaced the cloud abstractions devs rely on - highlighting a growing gap between slick DevOps dashboards and the gritty realities of heat, cost, and silicon. EnterGPUOps. It's not just a trend - it’s a new layer in the stack. Think observability w.. read more  

The Rise of GPUOps: Where Infrastructure Meets Thermodynamics
Link
@kala shared a link, 1 month ago
FAUN.dev()

Don't fall into the anti-AI hype

The writer recently left their job to explore AI and programming through various projects, including creating a YouTube channel focused on these topics. They discuss how AI is changing the landscape of programming, allowing for faster, more efficient coding methods. Despite concerns about job displa.. read more  

Link
@devopslinks shared a link, 1 month ago
FAUN.dev()

How we built an AI SRE agent that investigates like a team of engineers

Datadog just droppedBits AI SRE, an autonomous agent that thinks more like an SRE than a chatbot. It doesn't just regurgitate summaries - it investigates. It builds hypotheses, tests them against telemetry, and chases down actual root causes. Older tools leaned hard on LLMs to summarize alerts. That.. read more  

How we built an AI SRE agent that investigates like a team of engineers
Link
@devopslinks shared a link, 1 month ago
FAUN.dev()

Preparing for Post-Quantum Cryptography

NIST locked in itsPost-Quantum Cryptography (PQC) standardsin August 2024. The countdown’s on: U.S. federal systems need to make the leap by 2035. Wiz jumped early with aPQC Security Framework. It scans for shaky encryption, maps your crypto assets, and flags what’s PQC-ready, all cloud-wide, using .. read more  

Preparing for Post-Quantum Cryptography
Link
@devopslinks shared a link, 1 month ago
FAUN.dev()

What came first: the CNAME or the A record?

A recent change to 1.1.1.1 accidentally altered the order of CNAME records in DNS responses, breaking resolution for some clients. This post explores the technical root cause, examines the source code of affected resolvers, and dives into the inherent ambiguities of the DNS RFCs... read more  

What came first: the CNAME or the A record?
Link
@devopslinks shared a link, 1 month ago
FAUN.dev()

The best tools for bare metal automation that people actually use

Bare metal ops aren’t what they used to be. The game’s gone full stack:API-driven provisioning,declarative workflows, andconfig convergencenow run the show. Tools likeMAAS,Foreman,Ironic, andTinkerbelltreat physical servers as programmable units. Real hardware, real APIs. Meanwhile,Kubernetes-native.. read more  

The best tools for bare metal automation that people actually use
Link
@devopslinks shared a link, 1 month ago
FAUN.dev()

SSH has no Host header

A dev built a custom SSH proxy that punches through IPv4 limits without handing out public IPs like candy. Their trick:shared IPv4s with per-user relative IP mapping. It maps incoming SSH traffic to the right VM using thesource IPandpublic key combo. No Host header? No problem. They sidestep that ho.. read more  

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.