Lightnews — Scholar-powered news

Adrian Mouat @adrianmouat.com · 6h

I'm not sure this is the takeaway I'm supposed to have tbh 😂

Adrian Mouat @adrianmouat.com · 6h

Apparently Dockerfiles are Engineer's *favourite* maintenance task! (Fixing CI/CD pipelines was least favourite).

Read this and other great nuggets in @chainguard.dev 's Engineering Reality Report

Engineering Reality Report

A software engineer’s reality moving into 2026: what engineers want to do, and what they have to do

www.chainguard.dev

1

Adrian Mouat @adrianmouat.com · 1d

There are a few tickets left, but honestly not many, so I'd recommend getting one now if you're planning on going. Use this link for a small discount:

Kubernetes Community Days UK - Edinburgh 2025 | CNCF

In-person Event - Kubernetes Community Days UK - Edinburgh 2025

community.cncf.io

Adrian Mouat @adrianmouat.com · 1d

You do have to put up with me talking about supply chain security, but I'm really blown away by the quality of speakers we have this year. Keynotes include @lizrice.com @mt165.co.uk , @hannahfoxwell.net @lianmakesthings.bsky.social , @mccune.org.uk and @wiggitywhitney.bsky.social .

1 1 3

Adrian Mouat @adrianmouat.com · 1d

KCDUK in Edinburgh is next week!

Kubernetes Community Days UK - Edinburgh 2025 | CNCF

In-person Event - Kubernetes Community Days UK - Edinburgh 2025

kcduk.io

1 1 2

Reposted by Adrian Mouat

Giant Swarm @giantswarm.io · 1d

We’re speaking at @kcduk.bsky.social next week! Come say hi!

Antonia and Xavier are doing a live demo with a Pi and KubeEdge — Kubernetes at the edge, literally.

@salisburyheavyindustries.com talking about migrating a few hundred clusters to Cluster API and what we learned the hard way.

2 1

Adrian Mouat @adrianmouat.com · 2d

Natalie Somersall recently wrote a blog about how we can trust the provenance Open Source software. It's a thorny question, especially given Git's status; omnipresent but not designed for security and identity verification: https://tinyurl.com/yc6wtuju

1

Adrian Mouat @adrianmouat.com · 5d

I recently found this link to fantastic collection of resources for engineers.

Basically the most important books and articles to read if you're serious (or curious!) about software engineering:

GitHub - charlax/professional-programming: A collection of learning resources for curious software engineers

A collection of learning resources for curious software engineers - charlax/professional-programming

github.com

2

Adrian Mouat @adrianmouat.com · 6d

Yeah, that makes sense. I guess you have to caveat that action from that repo will pass verification, but that seems reasonable.

Adrian Mouat @adrianmouat.com · 6d

You should be able to pull the needed value out of the cert e.g:

cosign download signature cgr.dev/chainguard/python:latest | jq '.Cert.URIs[0].Path'

python Container Image Versions | Chainguard

View python Container Image Versions information for the python image.

cgr.dev

1

Adrian Mouat @adrianmouat.com · 6d

There's some stuff here, including an example of the identity flag edu.chainguard.dev/open-source/...

How to Verify File Signatures with Cosign

Use Cosign to verify non-container software artifacts

edu.chainguard.dev

1

Adrian Mouat @adrianmouat.com · 6d

Yeah, exactly. You can provide a regex, but that's a different flag. Otherwise it basically needs to be the identity of the GitHub action that did the signing. Let me look for an example.

1

Adrian Mouat @adrianmouat.com · 6d

Tickets are going pretty fast, so I'd recommend getting one now if you're planning on going. Use this link for a small discount:

Kubernetes Community Days UK - Edinburgh 2025 | CNCF

In-person Event - Kubernetes Community Days UK - Edinburgh 2025

community.cncf.io

Adrian Mouat @adrianmouat.com · 6d

You do have to put up with me talking about supply chain security, but I'm really blown away by the quality of speakers we have this year. Keynotes include @lizrice.com @mt165.co.uk , @hannahfoxwell.net @lianmakesthings.bsky.social , @mccune.org.uk and @wiggitywhitney.bsky.social .

1 1 6

Adrian Mouat @adrianmouat.com · 6d

We are getting really close to KCDUK in Edinburgh now (under two weeks!).

Kubernetes Community Days UK - Edinburgh 2025 | CNCF

In-person Event - Kubernetes Community Days UK - Edinburgh 2025

kcduk.io

1 3

Adrian Mouat @adrianmouat.com · 7d

I'm hugely support of this, but I don't see how some of it will work -- if money and "tiers" is the problem, why wasn't this done before? I think disparate, non-profit orgs will find it difficult to run a commercial operation.

Am I missing something?

Adrian Mouat @adrianmouat.com · 7d

The OpenSSF released a blog calling for change:

Open Infrastructure is Not Free: A Joint Statement on Sustainable Stewardship – Open Source Security Foundation

An Open Letter from the Stewards of Public Open Source Infrastructure Over the past two decades, open source has revolutionized the way software is developed. Every modern application, whether written in Java, JavaScript, Python, Rust, PHP, or beyond, depends on public package registries like Maven...

tinyurl.com

1

Adrian Mouat @adrianmouat.com · 7d

One of the biggest problems in tech right now is the exploitation of Open Source. At the pointy end of this is are the package repositories like Maven, NPM, PyPI etc -- who are all run as a public good but have found themselves at the heart of supply-chain hacks.

1

Adrian Mouat @adrianmouat.com · 8d

@erikaheidi.bsky.social and myself wrote up this tutorial to get you started:

Build Java Containers with Jib

In this tutorial, you'll learn how to build minimal Java containers using Jib and Chainguard base images

tinyurl.com

2

Adrian Mouat @adrianmouat.com · 8d

If you're building Java applications into containers, make sure you check out the Jib project. Jib lets you build and push containers directly from maven/gradle, without even needing the Docker daemon to be present.

GitHub - GoogleContainerTools/jib: 🏗 Build container images for your Java applications.

🏗 Build container images for your Java applications. - GoogleContainerTools/jib

github.com

1 1 5

Reposted by Adrian Mouat

Rory McCune @mccune.org.uk · 9d

Calling all Kubernetes security interested folk. We're planning the next version of the OWASP Kubernetes Top 10, and have a survey to solicit ideas and feedback here docs.google.com/forms/d/e/1F... . Shouldn't take more than a couple of minutes to fill out and all feedback's welcome!

OWASP Kubernetes Top 10 2025 Survey

We're looking to update the OWASP Kubernetes Top 10 and as such want to canvas ideas on what should be included. The goal of the Top 10 is to provide awareness on the most serious risks that Kubernet...

docs.google.com

7 5

Adrian Mouat @adrianmouat.com · 9d

If you are impacted by the changes to Bitnami Helm Charts, please check out my new video on migrating to @chainguard.dev Helm Charts.

I hope this helps some of you! Note that Helm Charts are available to our paid subscribers only.

Enjoy the videos and music that you love, upload original content and share it all with friends, family and the world on YouTube.

tinyurl.com

Adrian Mouat @adrianmouat.com · 10d

Boy. Yeah, you can even get pee cone things. He's a year now though so it seems almost intentional 😅

Adrian Mouat @adrianmouat.com · 11d

You know how squids squirt ink when they feel threatened? My 1 yo seems to feel peeing is the appropriate response to a nappy change.

1 5

Adrian Mouat @adrianmouat.com · 12d

Here's the slides from my @gotocon.com Copenhagen talk "Supply Chain Security and the Real World:
Lessons from Incidents".

I hope you enjoyed it if you caught it earlier today!

Attendee Copy GOTOCph Supply Chain Security and the Real World

1

tinyurl.com

2 5