Updates and recent posts about Sigstore..

Posts
Description

Link

@kala shared a link, 1 month, 3 weeks ago

FAUN.dev()

Streamlining Security Investigations with Agents

Slack broke down how it's threading AI into its product without torching user trust.Slack AIleans hard ontenant-specific data isolationandzero data retention- no leftover crumbs from LLM interactions. Instead of piping user data through someone else’s APIs, Slack runs LLMs onits own infrawhere it ca.. read more

Link

@kala shared a link, 1 month, 3 weeks ago

FAUN.dev()

2025: The year in LLMs

2025 was the year LLMs stopped just answering questions and started building things.Reasoning modelslike OpenAI’s o-series and Claude Code took over tool-driven workflows. Asynchronous coding agentsbroke out. These models didn’t just write code - they ran it, debugged it, then did it again. That loo.. read more

Link

@kala shared a link, 1 month, 3 weeks ago

FAUN.dev()

Meet the ‘Mad Max’-Loving CEO Challenging Nvidia With a Renegade Chip

June Paik spurned a takeover offer from Meta Platforms last year. Now his South Korean company, FuriosaAI, has an AI chip entering mass production... read more

Link

@kala shared a link, 1 month, 3 weeks ago

FAUN.dev()

The Architects of AI Are TIME's 2025 Person of the Year

The Architects of AI drove the economy, shaped geopolitics, and changed the way we interact with the world... read more

Link

@kala shared a link, 1 month, 3 weeks ago

FAUN.dev()

My LLM coding workflow going into 2026

Anthropic saysClaude Code writes about 90% of its own code now. Why? Because devs are getting smart with AI. They're slicing problems into tight, testable chunks and running structured workflows that keep LLMs on a short leash. It's not just prompts anymore. Think context packaging, multi-agent setu.. read more

Link

@devopslinks shared a link, 1 month, 3 weeks ago

FAUN.dev()

Race Condition in DynamoDB DNS System: Analyzing the AWS US-EAST-1 Outage

A long AWS smackdown in US-EAST-1 traced back to a ticking time bomb inDynamoDB’s automated DNS system. The flaw torpedoed EC2 networking, hobbled Lambda and Fargate, and dragged down theNetwork Load Balancer. Endpoints ghosted. Configs stalled. Everything snowballed. AWS says they’ll upgrade EC2 th.. read more

Link

@devopslinks shared a link, 1 month, 3 weeks ago

FAUN.dev()

You don’t need NAT gateway to deploy Lambda into VPC

AWS just made a big dent in NAT gateway bills. You can now runLambda in VPCs with IPv6 and an egress-only Internet gateway- no more always-on NAT draining your wallet. Keep the private subnets locked down. Still get outbound Internet access. IPv6 handles the traffic, slicing out the NAT middleman... read more

Link

@devopslinks shared a link, 1 month, 3 weeks ago

FAUN.dev()

Datacenters in space are a terrible, horrible, no good idea.

A former NASA engineer - now a Google Cloud AI infra alum - rips apart the idea of building GPU datacenters in orbit. His verdict: space is a terrible server rack. Power delivery? A nightmare. Heat dissipation? Worse in a vacuum. Radiation? Frying time. Even a 200kW solar rig (think ISS-sized) could.. read more

Link

@devopslinks shared a link, 1 month, 3 weeks ago

FAUN.dev()

ArgoCD diffs at scale

Monday.com ditched ArgoCD's built-in manifest diffing. Instead, they wired up a custom CI renderer that pre-renders Helm charts using real cluster data. Then it compares the desired states across Git branches. The kicker: diffs go to a UI with custom grouping support. Reviews get easier. New devs ge.. read more

Link

@devopslinks shared a link, 1 month, 3 weeks ago

FAUN.dev()

Designing a Scalable Serverless Contact System with AWS and Terraform

TravelEase Inc., a growing travel company, significantly improved customer inquiries handling by replacing a basic mailto: link with a modular, serverless, cloud-native system managed with Terraform. This new system automated message validation, processing, storage, and notifications using Lambda fu.. read more

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.