Join us

ContentUpdates and recent posts about Sigstore..
Story
@viktoriiagolovtseva shared a post, 2 days ago

A Ready-to-Use Business Travel Template For Jira

For many of us, even planning a personal trip can be a daunting task. Missing one detail when booking a flight or hotel can lead to a disaster. The challenge becomes even greater when you need to organize a business trip for others, especially for large events where many people travel simultaneously. 

Additionally, business travel often requires multiple approvals and cross-team collaboration. You will need a solution to keep everyone on the same page and easily track every detail. A business travel template for Jira is an ideal way to solve this challenge. 

In this blog post, we share a ready-to-use template and explain how to use it.

Zrzut ekranu 2025-12-17 143647
Story
@laura_garcia shared a post, 3 days ago
Software Developer, RELIANOID

🚀 AI is redefining Site Reliability Engineering (SRE)

What started as ensuring web apps were fast and resilient has now entered a new era: AI Reliability Engineering. Inference workloads demand speed, trust, and observability far beyond traditional infrastructure challenges. In our latest blog, we explore: Why unreliable AI is worse than no AI at all H..

relianoid_blog_documentation
Story
@laura_garcia shared a post, 3 days, 22 hours ago
Software Developer, RELIANOID

💶 The EU is investing €1.3 BILLION in AI, cybersecurity, and digital skills.

What does it mean for your organization? The European Commission's massive investment is a clear signal: digital security is a top priority for Europe's future. Now is the time to adopt secure, compliant, and high-performance solutions—like RELIANOID. ✅ Cybersecurity by design ✅ Ready for UK & EU re..

Blog EU Investment in Cybersecurity
Story Xygeni Team Trending
@mashka shared a post, 4 days, 2 hours ago
Paid Acquisition and Growth Marketing, xygeni

New Threats in Open Source: Worms, AI-Driven Malware, and Trust Abuse

Open source security just hit a new level: self-spreading worms, AI-run attacks, and registry abuse at a massive scale. Shai-Hulud, GlassWorm, and AI-orchestrated intrusions show how fast threats now move, and how easily one stolen token can infect entire ecosystems. The supply chain has changed. Our defenses must too.

New-Threats-in-Open-Source-Worms-AI-Driven-Malware-and-Trust-Abuse-1
Story
@priya_prabu shared a post, 4 days, 3 hours ago
Senior Product Marketer

Key Oracle performance metrics

Oracle performance issues rarely come from a single metric. This guide breaks down the most important Oracle performance indicators across instance health, memory, storage, waits, SQL, and availability, and shows how to use them together to detect bottlenecks early and prevent downtime.

Story FAUN.dev() Team
@eon01 shared a post, 4 days, 3 hours ago
Founder, FAUN.dev

Microk8s vs K3s

Kubernetes k3s MicroK8s Rancher k3d

To truly master Kubernetes, you need a safe sandbox, and running a lightweight distribution is the perfect solution for your local development workflow. These smaller K8s flavors provide a full-featured, yet constrained, environment that is easy on system resources. Both MicroK8s (maintained by Canonical) and k3s (from Rancher) are popular, production-ready options that deliver the core K8s experience with minimal operational burden, low storage needs, and simple networking setups.

These two platforms are fantastic for learning, experimentation, rapid testing, and skill development. If you don't know which one to choose, this post will give you the quick overview you need to decide.

 Activity
@kaptain added a new tool k3d , 4 days, 5 hours ago.
Link
@varbear shared a link, 5 days, 15 hours ago
FAUN.dev()

Phishing for AWS Credentials via the New 'aws login' Flow

AWS rolled out a newaws loginCLI command using OAuth 2.0 with PKCE. It grabs short-lived credentials, finally pushing out those dusty long-lived access keys. But here’s the hitch:The remote login flow opens up a phishing gap. Since the CLI session and browser session aren’t bound, attackers could sp.. read more  

Phishing for AWS Credentials via the New 'aws login' Flow
Link
@varbear shared a link, 5 days, 15 hours ago
FAUN.dev()

SQLite JSON Superpower: Virtual Columns + Indexing - DB Pro Blog

SQLite’sJSON virtual generated columnspunch way above their weight. They let you index JSON fields on the fly, no migrations, no whining. Computed like real columns, queryable like real columns, indexable like real columns. But from JSON. Want flexibility without surrendering speed? This flips the s.. read more  

Link
@varbear shared a link, 5 days, 15 hours ago
FAUN.dev()

Guarding My Git Forge Against AI Scrapers

To stop a wave of scraping on their self-hosted Forgejo, the author stacked defenses like a firewall architect on caffeine. First camemanual IP rate-limiting. ThenNGINX caching and traffic shaping. Finally:Iocaine 3. That last one didn’t just block bots, it lured them into a maze of junk pages. The .. read more  

Guarding My Git Forge Against AI Scrapers
Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.