Join us

ContentUpdates and recent posts about Sigstore..
Link
@varbear shared a link, 4 weeks ago
FAUN.dev()

Formatting an entire 25 million line codebase overnight: the rubyfmt story

Stripe's Developer Productivity team rolled out rubyfmt, a Rust-based zero-config Ruby autoformatter, across 25 million lines of Ruby in one Saturday morning in 2024, after the project had been in flight since 2018 as Fable Tales's personal OSS work. The hard parts were Ruby itself (no Ruby parser e.. read more  

Formatting an entire 25 million line codebase overnight: the rubyfmt story
Link
@varbear shared a link, 4 weeks ago
FAUN.dev()

Why I'm leaving GitHub for Forgejo

The Dutch Ministry of the Interior launched code.overheid.nl, a self-hosted Forgejo instance for government source code. This move was driven by the need to own and control the platform where code is published. Forgejo was chosen over GitLab for its open-source nature and alignment with the ministry.. read more  

Link
@varbear shared a link, 4 weeks ago
FAUN.dev()

Making your own programming language is easier than you think (but also harder)

A game developer explains how he built a low-level modding language, including sandbox constraints, an AArch64 JIT, and a small C++ compiler... read more  

Making your own programming language is easier than you think (but also harder)
Link
@varbear shared a link, 4 weeks ago
FAUN.dev()

Replacing a 3 GB SQLite database with a 10 MB FST (finite state transducer) binary

Andrew Quinn shipped Taskusanakirja (tsk), a Finnish-English pocket dictionary with search-as-you-type, originally backed by a trie for ~400k base words plus a 3 GB SQLite FTS database to cover the 40-60M inflected forms that Finnish's agglutinative morphology demands. Reaching for BurntSushi'sIndex.. read more  

Link
@varbear shared a link, 4 weeks ago
FAUN.dev()

The Pulse: AI load breaks GitHub – why not other vendors?

GitHub leaders created the reliability problems through weak capacity planning. As AI-agent users drove heavier traffic, GitHub engineers found migration risk and engineering debt that teams had allowed to build up... read more  

The Pulse: AI load breaks GitHub – why not other vendors?
Link
@kaptain shared a link, 4 weeks ago
FAUN.dev()

Mirantis has entered into an agreement to be acquired by IREN

Mirantis has agreed to an acquisition by IREN. The companies have announced no customer-facing product changes... read more  

Mirantis has entered into an agreement to be acquired by IREN
Link
@kaptain shared a link, 4 weeks ago
FAUN.dev()

What kubectl debug doesn’t tell you: The silent evidence gap

kubectl debugsessions leave almost no forensic trace: by design,EphemeralContainerStatushas nolastStateorrestartCount, so the exit code, session duration, target container, and debugger logs disappear from the Kubernetes API the moment anything else updates the pod. That breaks incident handoffs (th.. read more  

What kubectl debug doesn’t tell you: The silent evidence gap
Link
@kaptain shared a link, 4 weeks ago
FAUN.dev()

Extending AI gateways with Rust

Every gateway ships with a set of built-in policies. Authentication. Rate limiting. Request routing. Prompt guards. These cover most use cases. But what about the ones they don’t cover? What if you need to add a custom header based on a database lookup? What if you need to transform a request body i.. read more  

Extending AI gateways with Rust
Link
@kaptain shared a link, 4 weeks ago
FAUN.dev()

v1.36: Deprecation and removal of Service ExternalIPs

Kubernetes v1.36 deprecatesService.spec.externalIPsand starts the removal path, finally closing CVE-2020-8554, the trust-everyone hole the field has carried since the early days. The project has recommended disabling it via theDenyServiceExternalIPsadmission controller since v1.21, but SIG Network h.. read more  

Link
@kaptain shared a link, 4 weeks ago
FAUN.dev()

When AI agents become contributors: How KubeStellar reached 81% PR acceptance

The KubeStellar Console team learned that AI coding agents improve after engineers build deterministic feedback loops into the codebase. Engineers who grant more autonomy give agents more room to guess, with no new correction signal... read more  

When AI agents become contributors: How KubeStellar reached 81% PR acceptance
Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.