EVERYTHING XIAOMI
Get listed

Notation

Notation is a free, open-source command-line tool for signing and verifying container images and other artifacts stored in OCI registries, including software…

Place
#13 of 28
Score
6.1
Notation's website

What Notation is

Notation is a free, open-source command-line tool for signing and verifying container images and other artifacts stored in OCI registries, including software bills of materials. It implements the Notary Project specifications, which are intended to help secure software supply chains. Developers and CI/CD pipelines can create signatures and keep them alongside signed artifacts. Those signatures can be copied between OCI registries and validated in connected, occasionally connected, or disconnected environments without extra server infrastructure. Notation can work with existing key management systems, including through a plugin model; project materials link workflows for Azure Key Vault and AWS Signer. The specifications define OCI signature envelopes using COSE or JWS. Notation runs on Linux, macOS, and Windows, and the project offers a quick start for signing and validating a container image. The project is licensed under Apache 2.0. Users can ask questions in the Notary Project Slack channel or join community meetings; support details are linked through supported-release information.

Good

  • Supports OCI images, other artifacts, and SBOMs.
  • Signatures can move between OCI registries.
  • Validation works in disconnected environments.
  • Integrates with existing key-management systems.
  • Available on Linux, macOS, and Windows.

Watch out

  • It is a command-line tool.
  • No certificate is provided.
  • The project directs users to separate supported-release information for support details.

Who it suits

Notation suits developers and CI/CD teams that need to sign and verify OCI artifacts, including container images and SBOMs. It may fit workflows that use existing key-management systems and need signatures to move across registries.

Verdict

Notation provides a specification-based approach to signing and verifying OCI artifacts, with support for portable signatures and existing key-management systems. Its command-line workflow is suited to developers and CI/CD pipelines.

Plans and prices

From Notation's own pricing page, checked 8 Oct 2026.

All about pricing
PlanPriceWhat it gives you
Notary Project NotationFreeApache 2.0 licensed CLI project

The facts

Each one read from Notation's own pages, with the date it was checked.

What it does

Community
Users can ask questions in the Notary Project Slack channel and join community meetings.checked 8 Oct 2026
Envelopes
The specifications define OCI signature envelopes using COSE or JWS.checked 8 Oct 2026
Fuzz testing
The project overview says continuous fuzz testing is implemented for the notary, notation-go, and notation-core-go repositories.checked 8 Oct 2026
Integrations
The project README links to signing workflows using Azure Key Vault and AWS Signer.checked 8 Oct 2026
Intended users
The README describes Notation as usable by developers and CI/CD pipelines to produce portable signatures and store them with signed artifacts in OCI-compliant registries.checked 8 Oct 2026
Key management
The project supports integration with existing key management systems, including through a plugin model.checked 8 Oct 2026
Key management integrations
The project links instructions for using Notation with Azure Key Vault and AWS Signer.checked 8 Oct 2026
License
The Notation project is covered under the Apache 2.0 license.checked 8 Oct 2026
Portable signatures
Signatures produced under the specification can be copied between OCI registries and validated in connected, occasionally connected, and disconnected environments without extra server infrastructure.checked 8 Oct 2026
Purpose
Notation is a command-line tool for signing and verifying artifacts in OCI registries.checked 8 Oct 2026
Quick start
The project provides a quick start for signing and validating a container image.checked 8 Oct 2026
Security audits
The specifications repository lists a 2023 ADA Logics security audit covering Notation and related Go libraries.checked 8 Oct 2026
Signature use
The project describes its signatures as providing security similar to checking Git commit signatures, while being generic enough for additional purposes.checked 8 Oct 2026
Standards
Notation implements the Notary Project specifications for signing and verification.checked 8 Oct 2026
Supply chain
The Notary Project aims to secure software supply chains using authentic container images and other OCI artifacts.checked 8 Oct 2026
Support
The README directs users to the Notation supported releases information for support details.checked 8 Oct 2026

Alternatives to Notation

All alternatives
  1. 1Sigstore logo

    Sigstore

    Free planOpen sourceWebAPILinuxmacOS
    7.6Free plan
    Visit
  2. 2SignPath logo

    SignPath

    Free planWebAPILinuxmacOS
    7.2Free plan
    Visit
  3. 3AWS Signer logo

    AWS Signer

    Free planWebAPILinuxmacOS
    7.1Free plan
    Visit
  4. 4

    Cosign

    Free planLinuxmacOSSelf-hostedWindows
    6.6Free plan
    Visit
  5. 5

    OpenPubkey

    Free planAPILinuxmacOSSelf-hosted
    6.6Free plan
    Visit
  6. 6SignServer logo

    SignServer

    Free planWebAPILinuxmacOS
    6.5Free plan
    Visit