I wrote an article about my journey of winning the “Best Sigstore Evangelist” to encourage people to become the next best sigstore evangelist. It was published on the Sigstore blog recently. A while ago, Feynman Zhao, one of my friends, reached out to me from Twitter DM and said, “Your blog post has been translated into Chinese and retweeted by OpenSSF China,” and that was another OMG kind of moment in my life 🙈
𝚍𝚎𝚟𝚎𝚕𝚘𝚙𝚎𝚛-𝚐𝚞𝚢@developerguyba
This post published on @projectsigstore has been translated into Chinese and retweeted by @theopenssf China 🥳 Thanks so much, @FeynmanZhou, for letting me know about it 🤝 mp.weixin.qq.com/s/_dW7ZmJsvLfW…
𝚍𝚎𝚟𝚎𝚕𝚘𝚙𝚎𝚛-𝚐𝚞𝚢 @developerguyba
I'm so thrilled to announce that my blog post about my story of becoming the Best Sigstore Evangelist is now reachable on @projectsigstore blog 🥳 This blog is based on my experience, and I hope it will be inspiring for the people 👋 https://t.co/oFPEA84zUZ
6:30 PM · Jan 6, 2023
3 Likes
A while ago, CNCF announced an important update about the scholarship for the KubeCon + CloudNativeCon Europe. If you ask what the importance of these scholarships is, they give you a chance to attend KubeCon if you still need to attend them. So, please apply for these kinds of scholarships to keep your dream alive 🔥
I wrote a blog post about the OCI Image Layout, impressed by the talk by Brandon Mitchell, and it was published on the Continuous Delivery Foundation blog a while ago. The CDF told me it got over 1K hits on LinkedIn, which is awesome, so I’m so glad to them for helping me to create such an impact 🥳
Sigstore always publishes monthly roundups, which is one of the utmost critical ways of keeping yourself notified about the recent updates all along with the Sigstore community in one of the roundups, specifically the December Roundup; thanks to the Sigstore, they mentioned my blog post in the “New Content” section, but this is not the only section within the roundup, you will find lots of notable updates in different categories related with the community 📣
The OpenSSF community shared two important reports recently: “2022 In Year Review” and “2022 Annual Report”. These kinds of reports are essential for us to see all the efforts made so far from a single point. You should go and check out the highlights of the year 2022 on behalf of the OpenSSF community; thanks to Chainguard, they wrote another blog post to summarize all these highlights from their point of view. 🖼
Chainguard ⛓️@chainguard_dev
Highlights from @theopenssf annual report: ☝️Developed new security tools + resources 🫰Improved the security of OSS projects For 2023🔛 🤝SBOM everywhere + replacement of non-memory-safe languages 👏Supply Chain Integrity Working Group 🙌Sigstore adoption chainguard.dev/unchained/high…
chainguard.dev
Highlights from OpenSSF’s 2022 Annual Report
2:06 PM · Jan 3, 2023
7 Reposts · 8 Likes
The wait-for-it project is one of the most actively used projects in the SPIFFE ecosystem. One day, we found an issue created by Eli Nesterov complaining about the vulnerability count of the wait-for-it image built from here and used in the spire-tutorials project. At that time, we saw an opportunity to use Apko + Melange tools to create a CVEless version of it and ship it with Chainguard images. According to that, we built a new version of the wait-for-it image, and it’s now available for everyone at the registry URL cgr.dev/chainguard/wait-for-it. And the PR we created to promote using Chainguard’s version of the wait-for-it image is now merged, which means that SPIFFE is using this in official projects. 🥳
Dan Lorenc@lorenc_dan
The "toolbelt" set of @chainguard_dev images is growing fast! Thanks to @developerguyba and friends we have a great "wait-for-it" image to test for service availability. github.com/chainguard-ima…
11:28 PM · Jan 3, 2023
3 Reposts · 14 Likes
Nuno Coração, who is working for Docker as Product, shared a Tweet about Career Openings at Docker and if you are interested in joining Docker, please follow this tweet below🤞
Nuno Coração@nunocoracao
If you said “yes” 1) check the open positions in docker.com/career-opening… 2) DM with the position you would like and why 👍
docker.com
Docker Careers | Opportunities Available | Docker
12:45 AM · Jan 7, 2023
2 Reposts · 17 Likes
Recently, Eric Smalling talked about the different ways of building OCI images without requiring any Dockerfiles or a running docker daemon in one of the events of DevOpsDaysDFW. In one of the sections of his presentation, he mentions the ko project, a very new CNCF sandbox project created by two amazing people, Jason Hall and Matt Moore, that simplifies building container images and securely. But there was a small mistake in Eric’s presentation about ko. He used the following picture and said, “ko signs the generated SBOM and uploads it to the Rekor” this is not right at the moment I’m writing this. Still, on the other hand, this is a brilliant idea; at least, this is something we must discuss on it, so come and join to #ko-build channel on Kubernetes slack to share your opinions about it.
Eric Smalling is @ericsmalling@hacyderm.io 🇺🇦@ericsmalling
@developerguyba @OCI_ORG @DevOpsDaysDFW Thx for the reference, but note that I misstated something: around 6:08 I said SBOM is signed & stored in Rekor, that's not right. Ko actually does the equivalent of a `cosign upload` of the SBOM to a container registry, but a signature isn't applied. Sorry for any confusion.
2:31 PM · Jan 5, 2023
1 Repost · 2 Likes
There has been an ongoing election for a new co-chair of the Continuous Delivery Foundation (CDF) Software Supply Chain SIG, which is finally ended. Congratulations to David Bendory; he has been elected as the new SIG co-chair. 👏
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.