Cosign
6.6#4 in code signing softwareFree planFree planLinuxmacOSSelf-hostedWindows
VisitCosign vs Notation
What both publish
| Fact | Cosign | Notation |
|---|---|---|
| Intended users | The Sigstore integration guidance identifies open-source package managers as primary stakeholders for artifact signing and verification workflows. | The README describes Notation as usable by developers and CI/CD pipelines to produce portable signatures and store them with signed artifacts in OCI-compliant registries. |
| Purpose | Cosign signs and verifies OCI containers and other software artifacts. | Notation is a command-line tool for signing and verifying artifacts in OCI registries. |
| Support | The project directs users with issues to open a GitHub issue or ask in its Slack channel. | The README directs users to the Notation supported releases information for support details. |
Cosign plans
- CosignFree
Notation plans
- Notary Project NotationFree
Pick Cosign if…
Cosign suits open-source package managers and teams that need to sign or verify artifacts in registry and CI/CD workflows. It is less suited to developers seeking a stable API for direct application integration.
Pick Notation if…
Notation suits developers and CI/CD teams that need to sign and verify OCI artifacts, including container images and SBOMs. It may fit workflows that use existing key-management systems and need signatures to move across registries.