Notation

Open source

Open source tool and specification for signing and verifying container artifacts.

by The Notary ProjectOfficial site ↗Source code ↗

Pricing: free
License: open-source
Open source: Yes

Editorial review

Notation has not yet been editorially reviewed. User reviews and published field data below are unaffected — we say so rather than implying an editorial verdict.

Facts & attributes

Every value carries its evidence state. “—” means unknown — never a silent default (P-02).

Identity · Taxonomy

Tags(open-source;cloud-native): artifact signing, supply chain security, OCI registry, PKI, CNCFVerification pending

Pricing · Licensing

License model(proprietary;open-source;source-available;dual-license): open-sourceVerification pending
Pricing model(free;subscription;usage;seat;asset;transaction;revenue-share;perpetual;custom): freeVerification pending
Source repository(HTTPS URL): https://github.com/notaryproject/notationVerified
SPDX license IDs(Apache-2.0;MIT): Apache-2.0Verified

Features · Product · Fit

Core capabilities(authoring;automation;analytics): Cryptographic signing supporting COSE and JWS signature formats, Sign and verify any software artifacts, not only images, Fine-grained trust policies to determine artifact authenticity, Push and store signatures alongside artifacts in OCI compliant registries, Pluggable design with SDK for custom clients, Simple CLI commands automating signing and verificationVerification pending

Api · Integrations · Ecosystem

CLI(true/false): trueVerification pending

Audience · Use · Case

Best for(Neutral editorial summary): Teams signing and verifying artifacts with COSE/JWS signatures and PKI trust policies across OCI-compliant registriesVerification pending
Primary use cases(build;monitor;automate): Secure containers and K8s, DevSecOps, Auditing and complianceVerified

Lifecycle · Versioning

Current version(1.12.3): 2.0.0-alpha.1Verified
Maintenance status(active;maintenance;deprecated;EOL;archived): activeVerified

User reviews

Review policy

No published reviews yet.