Lightnews — Scholar-powered news

Adrian Mouat @adrianmouat.com · 1h

Yeah, exactly. You can provide a regex, but that's a different flag. Otherwise it basically needs to be the identity of the GitHub action that did the signing. Let me look for an example.

Adrian Mouat @adrianmouat.com · 1h

Tickets are going pretty fast, so I'd recommend getting one now if you're planning on going. Use this link for a small discount:

Kubernetes Community Days UK - Edinburgh 2025 | CNCF

In-person Event - Kubernetes Community Days UK - Edinburgh 2025

community.cncf.io

Adrian Mouat @adrianmouat.com · 1h

You do have to put up with me talking about supply chain security, but I'm really blown away by the quality of speakers we have this year. Keynotes include @lizrice.com @mt165.co.uk , @hannahfoxwell.net @lianmakesthings.bsky.social , @mccune.org.uk and @wiggitywhitney.bsky.social .

1 1 3

Adrian Mouat @adrianmouat.com · 1h

We are getting really close to KCDUK in Edinburgh now (under two weeks!).

Kubernetes Community Days UK - Edinburgh 2025 | CNCF

In-person Event - Kubernetes Community Days UK - Edinburgh 2025

kcduk.io

1 1

Adrian Mouat @adrianmouat.com · 1d

I'm hugely support of this, but I don't see how some of it will work -- if money and "tiers" is the problem, why wasn't this done before? I think disparate, non-profit orgs will find it difficult to run a commercial operation.

Am I missing something?

Adrian Mouat @adrianmouat.com · 1d

The OpenSSF released a blog calling for change:

Open Infrastructure is Not Free: A Joint Statement on Sustainable Stewardship – Open Source Security Foundation

An Open Letter from the Stewards of Public Open Source Infrastructure Over the past two decades, open source has revolutionized the way software is developed. Every modern application, whether written in Java, JavaScript, Python, Rust, PHP, or beyond, depends on public package registries like Maven...

tinyurl.com

1

Adrian Mouat @adrianmouat.com · 1d

One of the biggest problems in tech right now is the exploitation of Open Source. At the pointy end of this is are the package repositories like Maven, NPM, PyPI etc -- who are all run as a public good but have found themselves at the heart of supply-chain hacks.

1

Adrian Mouat @adrianmouat.com · 2d

@erikaheidi.bsky.social and myself wrote up this tutorial to get you started:

Build Java Containers with Jib

In this tutorial, you'll learn how to build minimal Java containers using Jib and Chainguard base images

tinyurl.com

2

Adrian Mouat @adrianmouat.com · 2d

If you're building Java applications into containers, make sure you check out the Jib project. Jib lets you build and push containers directly from maven/gradle, without even needing the Docker daemon to be present.

GitHub - GoogleContainerTools/jib: 🏗 Build container images for your Java applications.

🏗 Build container images for your Java applications. - GoogleContainerTools/jib

github.com

1 1 5

Reposted by Adrian Mouat

Rory McCune @mccune.org.uk · 2d

Calling all Kubernetes security interested folk. We're planning the next version of the OWASP Kubernetes Top 10, and have a survey to solicit ideas and feedback here docs.google.com/forms/d/e/1F... . Shouldn't take more than a couple of minutes to fill out and all feedback's welcome!

OWASP Kubernetes Top 10 2025 Survey

We're looking to update the OWASP Kubernetes Top 10 and as such want to canvas ideas on what should be included. The goal of the Top 10 is to provide awareness on the most serious risks that Kubernet...

docs.google.com

7 5

Adrian Mouat @adrianmouat.com · 3d

If you are impacted by the changes to Bitnami Helm Charts, please check out my new video on migrating to @chainguard.dev Helm Charts.

I hope this helps some of you! Note that Helm Charts are available to our paid subscribers only.

Enjoy the videos and music that you love, upload original content and share it all with friends, family and the world on YouTube.

tinyurl.com

Adrian Mouat @adrianmouat.com · 4d

Boy. Yeah, you can even get pee cone things. He's a year now though so it seems almost intentional 😅

Adrian Mouat @adrianmouat.com · 4d

You know how squids squirt ink when they feel threatened? My 1 yo seems to feel peeing is the appropriate response to a nappy change.

1 5

Adrian Mouat @adrianmouat.com · 5d

Here's the slides from my @gotocon.com Copenhagen talk "Supply Chain Security and the Real World:
Lessons from Incidents".

I hope you enjoyed it if you caught it earlier today!

Attendee Copy GOTOCph Supply Chain Security and the Real World

1

tinyurl.com

2 5

Reposted by Adrian Mouat

Richi Jennings @richi.bsky.social · 5d

#Japan’s biggest producer of beer is still not producing any beer this week. #Asahi Group Holdings shut down production Monday after detecting a cyber intruder.

And today it’s confirmed fears of #ransomware. In #SBBlogwatch, we dry out.

securityboulevard.com/2025/10/japa...

Asahi Hack Update: Beer-Free Day #5 Dawns in Japanese Ransomware Crisis

金のうんこ！ Breaking: Big beer brewer belatedly believes bitten by ransomware—and likely a data breach.

securityboulevard.com

4 4

Adrian Mouat @adrianmouat.com · 6d

For those of you at GOTO Copenhagen, I'll be speaking at 14.15 in room 2 about what we can and should be learning from recent security incidents.

Supply Chain Security and the Real World: Lessons From Incidents

Conference talk with Adrian Mouat at GOTO Copenhagen 2025

f.mtr.cool

1 1

Adrian Mouat @adrianmouat.com · 6d

For those of you at GOTO Copenhagen, I'll be speaking at 14.15 in room 2 about what we can and should be learning from recent security incidents.

Supply Chain Security and the Real World: Lessons From Incidents

Conference talk with Adrian Mouat at GOTO Copenhagen 2025

f.mtr.cool

Adrian Mouat @adrianmouat.com · 7d

If you're at GOTO Copenhagen, I'll be on Sam Newman's Graham Norton style chat show alongside Kief Morris at 15.15 today. It's on the live stage, which is up the spiral stairs at the back (good luck).

For those of you not lucky enough to be there, I think it is recorded.

2

Adrian Mouat @adrianmouat.com · 9d

I'm hosting a @chainguard.dev Learning Lab tomorrow (6pm UK) on how to get started with Chainguard Images. The Lab focuses on using the free static image, which is perfect for compiled binaries produced by Go, Rust, C etc.

Learning Labs: Static Chainguard Images

During this hands-on lab, you'll learn how to create container images that have low-to-zero CVEs and are much smaller than standard images. This lab is focused on producing images for compiled languages that can produce static binaries, such as Go, Rust and C.‍We'll discuss:Why reducing the size and CVE count of images is importantHow to migrate a Dockerfile build using a compiled language to use Chainguard ContainersAdvanced techniques for producing truly minimal images and debugging‍

events.chainguard.dev

1

Reposted by Adrian Mouat

Gergely Orosz @gergely.pragmaticengineer.com · 11d

How is this not bigger news in tech/security circles.

Jaguar Land Lover lost $250M (£200M) and counting thanks to a cyberattack that it still couldn’t mitigate. This is growing every week.

The cost of underinvesting in security is very real. 1+ month recovery is bonkers

60 250 910

Adrian Mouat @adrianmouat.com · 12d

If you use Helm charts (maybe from a provider who recently changed their terms...) you might want to checkout @chainguard.dev's iamguarded Charts.

I did a video a little while back on getting started with the postgres chart

Using Chainguard's Helm Charts

Tutorial on using the Helm Charts now available from Chainguard.This tutorial demonstrates the following tools: - Helm (https://helm.sh) - Kind (for creating...

www.youtube.com

Adrian Mouat @adrianmouat.com · 13d

Echo, if a 3 yo asks for a nursery rhyme, they don't want the instrumental version.

1

Adrian Mouat @adrianmouat.com · 13d

Link should be community.cncf.io/events/detai...

Kubernetes Community Days UK - Edinburgh 2025 | CNCF

In-person Event - Kubernetes Community Days UK - Edinburgh 2025

community.cncf.io

Adrian Mouat @adrianmouat.com · 14d

I'm definitely looking forward to @lizrice.com's @kcduk.bsky.social keynote on "Building a successful Cloud Native Business on Open Source".

There's a tension here and it seems to have ramped up recently with the end of ZIRP. I'm keen to hear Liz's take! Join me on 21st Oct. tix: kcduk.io

1 1 3

Adrian Mouat @adrianmouat.com · 14d

Today Dan Lorenc (@chainguard.dev CEO)will be answering questions on the community slack. If you’ve ever wanted to ask him about containers, open source, or how to secure a supply chain (or his favourite head gear, trust me he has options) this is your chance.

Join Chainguard Community on Slack - Community Inviter

Join Chainguard Community on Slack. Powered by Community Inviter. You will get an invitation soon. Check your inbox.

go.chainguard.dev