Side by side
Notation vs SignPath Foundation
Both stand on code signing software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan LinuxMacWindows
Choose Notation if you need a free CLI for signing and verifying OCI artifacts across development or CI/CD workflows. Its portable signatures and key management integrations support varied environments. Look elsewhere if you need a certificate supplied with the tool.
Visit Notation
Free plan APIWeb
SignPath Foundation offers signing certificates for qualifying open-source projects, with build verification and protected keys. Manual approval is required for each release, and applying does not guarantee acceptance.
Visit SignPath FoundationThe facts
| Notation | SignPath Foundation | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Not published |
| Runs on | Linux, Mac, Windows | API, Web |
| Lowest paid plan | Free or on request | Free or on request |
| Plans published | 1 | 1 |
| Maker | Not published | Not published |
| Website | notaryproject.dev | signpath.org |
| On code signing software | #6 of 28 | #10 of 28 |
Notation: what it does well
- Free, open-source CLI under the Apache 2.0 license.
- Runs on Linux, macOS, and Windows.
- Signatures can move between OCI registries.
- Validation works in disconnected environments without extra server infrastructure.
- Integrates with existing key management systems through plugins.
What to know first
- The project does not provide a certificate.
- The tool focuses on OCI registries and OCI artifacts.
- Support details are directed to supported release information.
SignPath Foundation: what it does well
- Certificate private keys are kept on a hardware security module
- Verifies signed files are automated builds from the stated repository
- Supports several trusted build systems
- Free subscription for eligible open-source projects
What to know first
- Every release requires manual signing approval
- Eligibility excludes proprietary code and malware
- Certificate names SignPath Foundation as publisher
- The Foundation may reject an application
Alternatives to Notation Alternatives to SignPath Foundation The whole list