Notation
6.1#13 in code signing softwareFree planFree planLinuxmacOSWindows
VisitNotation vs Sigstore
What both publish
| Fact | Notation | Sigstore |
|---|---|---|
| Key management | The project supports integration with existing key management systems, including through a plugin model. | Sigstore generates signatures with ephemeral signing keys, so developers do not need to manage keys. |
| License | The Notation project is covered under the Apache 2.0 license. | Sigstore projects are required to use the Apache License 2.0 and include a compatible dependency-license check. |
| Purpose | Notation is a command-line tool for signing and verifying artifacts in OCI registries. | Sigstore is an open source project for improving software supply chain security. |
| Support | The README directs users to the Notation supported releases information for support details. | Community support is provided through Slack and GitHub issues, with repository CODEOWNERS identifying project maintainers. |
Notation plans
- Notary Project NotationFree
Sigstore plans
- FreeFree
- Public-good Sigstore serviceFree
Pick Notation if…
Notation suits developers and CI/CD teams that need to sign and verify OCI artifacts, including container images and SBOMs. It may fit workflows that use existing key-management systems and need signatures to move across registries.
Pick Sigstore if…
Sigstore suits developers and software providers seeking signing and verification workflows for software artifacts. It may also be relevant to package managers integrating signing into their tooling or registries.