Notation

Notation is a free, open-source command-line tool for signing and verifying container images, SBOMs, and other OCI artifacts. It suits developers and CI/CD teams that need signatures to move with artifacts between registries and environments. Its strongest case is portable, standards-based verification; teams that need a certificate bundled with the tool should choose another approach.

Overview

Notation implements the Notary Project specifications for signing and verification, giving software teams a way to check the authenticity of artifacts in an OCI-based supply chain. The project covers container images and other OCI artifacts rather than limiting signing to one image format.

Its practical distinction is portability. A signature can be copied between OCI registries and validated in connected, intermittently connected, or disconnected environments without additional server infrastructure. That is useful when releases pass through multiple registries, move into restricted networks, or must be checked at the edge.

Notation offers a quick start for signing and validating a container image. The project compares the security purpose of its signatures with checking Git commit signatures, while keeping the format generic enough for other uses. It creates signatures but does not supply a certificate, so certificate provisioning remains part of your deployment design.

Key features

Standards-based OCI signing

The tool follows Notary Project specifications and defines OCI signature envelopes using COSE or JWS. That gives teams a documented format for attaching verification data to OCI artifacts, including SBOMs, instead of creating a proprietary signing workflow.

Portable verification

Signatures travel between OCI registries with the artifacts they protect and can be checked without a separate verification service. This favors organizations with registry migrations, disconnected operations, or several deployment environments. It does not remove the need to manage trust and keys correctly.

Key-management integrations

Notation supports existing key-management systems through a plugin model. Published workflows cover Azure Key Vault and AWS Signer, making it a better fit for teams that want signing keys managed in established cloud services rather than stored directly in a local workflow.

Supply-chain assurance

The project targets authentic software artifacts and supports CI/CD signing. Continuous fuzz testing is implemented for the notary, notation-go, and notation-core-go repositories, and a 2023 ADA Logics audit covers Notation and related Go libraries. These measures strengthen confidence in the project, but they do not replace your own policy, identity, or key controls.

Pricing

The Notary Project Notation plan costs free. It is an Apache 2.0-licensed open-source CLI project with no paid tier described, seat charge, usage quota, or trial term. That makes it suitable for individual developers, open-source maintainers, and organizations that can operate their own signing workflow.

The free price covers the software itself, not a supplied certificate or a managed signing service. Teams should account for the key-management system and operational controls they choose to integrate. The Apache 2.0 license also makes the project a practical option for internal automation and redistribution within license terms.

Platforms

Notation supports Linux, macOS, and Windows. It is designed for command-line use by developers and CI/CD pipelines, so it can fit heterogeneous build fleets rather than requiring a single hosted console.

Who it's for

Choose Notation for engineering teams signing OCI images, SBOMs, and related artifacts in build pipelines; platform teams moving signed artifacts across registries; and operators who need verification to work in occasionally connected or disconnected environments. It is also a sensible foundation when Azure Key Vault, AWS Signer, or another compatible key-management system is already part of your controls.

Look elsewhere if you want the signing product to include a certificate, or if you require a fully managed service instead of a command-line project that you integrate and operate.

Pros and cons

• Pro: Signatures remain portable across OCI registries and can be verified without extra server infrastructure.
• Pro: Supports OCI images, SBOMs, and other OCI artifacts through Notary Project specifications.
• Pro: Plugin-based key management and documented Azure Key Vault and AWS Signer workflows support established security environments.
• Pro: Free under the Apache 2.0 license, with Linux, macOS, and Windows support.
• Con: No certificate is provided, leaving certificate and trust setup to the adopting team.
• Con: A CLI project requires your organization to assemble the surrounding key, policy, and operational controls.

Alternatives

AWS Signer is the better choice when you want a paid service with integrations across AWS and other listed platforms, including no additional charge for use with several AWS services and third-party container services.

Choose Cosign instead for a free, open-source signing tool available on Linux, macOS, Windows, and self-hosted environments, with no hosted service or usage limits stated.

OpenPubkey suits teams seeking a free Apache 2.0 reference implementation with API, desktop, and self-hosted platform options.

Pick SignPath when an eligible open-source project needs its free open-source code-signing plan, subject to eligibility conditions.

SignServer is preferable if you need a community edition covering basic code, document, and container signing with timestamping, source-code or container deployment, and a free trial.

Sigstore is a free option for developers and software providers across API, self-hosted, desktop, and Windows environments.

SignPath Foundation is aimed at eligible, actively maintained open-source projects that meet its stated licensing and release conditions.

Aujas Automated Code Signing Platform is an alternative for organizations evaluating several signing-based, pay-as-use licenses.

Verdict

Notation is a strong choice for developers and CI/CD teams that need free, standards-based OCI signing whose signatures can move across registries and survive disconnected verification. Its Apache 2.0 license, cross-platform CLI, and key-management integrations keep adoption flexible. The main reason to look elsewhere is the missing certificate: teams wanting a bundled certificate or a managed end-to-end signing service will need another product.