About the Project at ASML

At ASML, everything revolves around precision and reliability, and that includes the software we release. The team we work in is responsible for tooling that ensures software patches are securely generated and signed before they go to production. This is crucial in an environment where software runs on machines worth millions of euros.

Since January 2026, I have combined two roles within ASML FCDevEnv: 0.6 FTE as Project Lead and 0.4 FTE as Software Engineer. This lets me connect delivery, stakeholder alignment, and Agile team processes directly with technical execution.

Project Scope

Patch Generation Service

We built a new patch generation service using a modern stack: FastAPI for the REST API, MySQL for data storage, and RabbitMQ with Celery for asynchronous processing of heavy tasks. In the future, the service will process hundreds of patch requests daily and needs to be available 24/7. We put a lot of effort into error handling, retry logic, and monitoring to ensure patches are generated reliably.

Artifact Signing Service

We also developed an artifact signing service secured via Okta and integrated with Keyfactor for its cryptographic workflows. This service enables signing of various artifact types: patches, RPMs, and regular files. The service works hash-based, meaning clients send a hash of their artifact and receive a signature back. This keeps the service stateless and prevents us from having to process large files.

RPM Library

For parsing and signing RPMs, we wrote a Python library. This library follows the RPM standards and implements the same logic as the RPM CLI tool. It supports RPM versions 3, 4, 5, and 6. Other teams can now use this library in their own pipelines to read and sign RPMs and embed the signature.

DevOps & Deployment

Our team is fully responsible for the entire deployment pipeline up to and including the ACC environment (production is managed by another team). This means we don't just write code, but also build Docker/Podman images, manage Kubernetes manifests, configure VMs, and maintain Ansible playbooks. We set up a complete CI/CD pipeline with automated testing, security scanning, and staged deployments.

Project Lead (0.6 FTE)

• Lead the Patch Signing project, owning delivery, planning, and coordination across a cross-functional team
• Act as a hybrid Project Lead, Product Owner, and Scrum Master, ensuring alignment between business stakeholders and engineering teams
• Define the project roadmap, priorities, and milestones to ensure timely delivery of critical functionality
• Manage stakeholders across multiple departments, aligning expectations and communicating progress, risks, and dependencies
• Facilitate sprint planning, stand-ups, reviews, and retrospectives while continuously improving team processes
• Proactively identify and mitigate risks related to reliability, scalability, and security
• Coordinate release planning and ensure production readiness for services with strict availability and security requirements

Software Engineering (0.4 FTE)

• Design and implement Python backend services using technologies such as FastAPI, Celery, RabbitMQ, MySQL, Pydantic, and SQLAlchemy
• Support DevOps efforts, including CI/CD pipelines, Kubernetes deployments, and infrastructure automation
• Drive technical decision-making with the team, balancing delivery speed with long-term maintainability