Notation

Notation is a command-line tool for signing and verifying OCI container images and other OCI artifacts, including software bills of materials. It implements the Notary Project specifications, which aim to support software supply chain security by helping users work with authentic artifacts. Developers and CI/CD pipelines can create signatures and store them with signed artifacts in OCI-compliant registries.

Signatures can be copied between OCI registries and validated in connected, occasionally connected, or disconnected environments without extra server infrastructure. Notation can work with existing key management systems through integrations and a plugin model; project instructions cover Azure Key Vault and AWS Signer. Its specifications define OCI signature envelopes using COSE or JWS. The project offers a quick start for signing and validating a container image, and directs users to supported release information for support details. Notation is available on Linux, macOS, and Windows under the Apache 2.0 license. It is free and open source. The project also describes continuous fuzz testing for several repositories and lists a 2023 security audit covering Notation and related Go libraries.

Notation provides a free, open-source route to sign and verify OCI artifacts across registry and network conditions. Teams can review its quick start and supported release information to judge whether it fits their workflows.

Notation suits developers and CI/CD teams that need to sign OCI images or other OCI artifacts and validate signatures across connected or disconnected environments. It may suit teams integrating signing with existing key management systems.

Notation is a free, open-source command-line tool for signing and verifying container images and other OCI artifacts. It best suits developers and CI/CD teams that need signatures to move with artifacts between registries. Its strength is portable verification without extra server infrastructure; teams must arrange certificates and key management for their own signing setup.

Overview

Notation implements the Notary Project specifications, which are intended to help secure software supply chains by letting teams verify the authenticity of OCI artifacts. Those artifacts include container images and SBOMs. Rather than tying validation to one registry or a continuously connected environment, the specifications allow signatures to travel between OCI registries and be checked in connected, occasionally connected, or disconnected settings.

That portability is valuable for teams that move artifacts across registry boundaries or need to verify them where connectivity is limited. Notation is a signing and verification tool, not a bundled certificate provider, so it does not by itself supply every part of a signing and trust setup. The project offers a quick start for signing and validating a container image, and frames the security purpose of its signatures as similar to checking Git commit signatures, while allowing broader uses.

Key features

Portable OCI signatures

Signatures can be copied between OCI registries and validated without additional server infrastructure. This makes Notation a practical fit for workflows that span registries or include disconnected environments. The signature envelopes defined by the specifications use COSE or JWS, giving teams those formats within the Notary Project approach.

Key management and signing workflows

Notation can integrate with existing key management systems, including through a plugin model. Project instructions cover Azure Key Vault and AWS Signer workflows, a useful starting point for teams already using either service. Those integrations do not change the fact that Notation itself provides no certificate, so organizations should account for certificate and trust requirements separately.

Security and release support

The specifications repository records a 2023 ADA Logics security audit covering Notation and related Go libraries. The project overview also describes continuous fuzz testing for the notary, notation-go, and notation-core-go repositories. These are meaningful security practices for a signing tool, though they do not eliminate the need to review supported releases and maintain the surrounding signing workflow.

The README directs users to supported release information for support details. Users can also ask questions in the Notary Project Slack channel and join community meetings. Notation is licensed under Apache 2.0.

Pricing

Notary Project Notation: free. The free plan is the Apache 2.0-licensed CLI project. It is suited to developers and teams that want to use and adapt an open-source tool for signing and verifying OCI artifacts. There are no paid tiers or usage caps described for this plan, but the project does not provide a certificate; the no-certificate limit matters to teams looking for a single bundled solution rather than a tool to integrate into their existing signing setup.

Platforms

Notation supports Linux, macOS, and Windows. Its command-line format and CI/CD use make it relevant to developers working across those operating systems, with signatures intended for OCI registries rather than a platform-specific artifact store.

Who it's for

Notation is a strong choice for developers and CI/CD pipelines that produce OCI artifacts and need portable signatures stored alongside signed artifacts in OCI-compliant registries. It is especially relevant when artifacts move between registries or must be verified in connected and disconnected environments. Teams that require a certificate provided by the product, or that do not work with OCI artifacts, should look elsewhere.

Pros and cons

• Pro: Signatures can move between OCI registries and be validated without extra server infrastructure, which helps across registry and network boundaries.
• Pro: Support for existing key management systems, plugin integration, and documented Azure Key Vault and AWS Signer workflows gives teams routes to fit signing into established tooling.
• Pro: The free Apache 2.0 license and Linux, macOS, and Windows support make the CLI accessible across common developer environments.
• Con: No certificate is provided, so teams must account for that in their signing and verification setup.
• Con: Notation is centered on OCI artifacts; it is not the right fit for teams whose signing needs do not involve that ecosystem.

Alternatives

Code Signing Software is the broader category to browse when Notation's OCI focus does not match the signing need.

• Cosign is another free, open-source option for Linux, macOS, Windows, and self-hosted environments; consider it when you want an alternative with no hosted service or usage limits stated.
• OpenPubkey is a free Apache 2.0 reference implementation for API, Linux, macOS, Windows, and self-hosted environments; choose it when that implementation and platform mix better suits your project.
• SignPath offers a free open-source code-signing plan subject to eligibility conditions; it may suit an eligible open-source project seeking that plan.
• SignPath Foundation has a free OSS subscription for eligible, actively maintained projects with an OSI-approved license, with manual signing required for every release; consider it if those terms fit your release process.
• SignServer has a free community plan for basic code, document, container signing, and timestamping, with source-code or container deployment; consider it for those broader signing needs.
• AWS Signer has no additional charge for use with AWS IoT Device Management, AWS Lambda, Amazon ECR, Amazon EKS, or third-party container services; it may fit teams whose workflows use those services.
• Sigstore is free to use for developers and software providers; consider it as another free option.
• Aujas Automated Code Signing Platform is an alternative with signing-based licenses and pricing not listed.

Verdict

Choose Notation if your developers or CI/CD pipelines need free, open-source signing and verification for OCI artifacts, especially when signatures must travel across registries or work without continuous connectivity. Its strongest case is portable validation without extra server infrastructure. Look elsewhere if you need a certificate bundled with the tool or need signing outside the OCI ecosystem.