Notation

Notation is a project to add signatures as standard items in the registry ecosystem, and to build a set of simple tooling for signing and verifying these signatures. This should be viewed as similar security to checking git commit signatures, although the signatures are generic and can be used for additional purposes. Notation is an implementation of the Notary V2 specifications.

Notation Quick Start
Contributing
Core Documents
Community
Release Management
Support
Code of Conduct
License

Notation Quick Start

Install the Notation CLI from Notation Releases

curl -Lo notation.tar.gz https://github.com/notaryproject/notation/releases/download/v0.7.1-alpha.1/notation_0.7.1-alpha.1_linux_amd64.tar.gz
tar xvzf notation.tar.gz -C ~/bin notation

Run a local instance of the CNCF Distribution Registry, with ORAS Artifacts support.
```
docker run -d -p 5000:5000 ghcr.io/oras-project/registry:v0.0.3-alpha
```

Build, Push, Sign, Verify the net-monitor software

export IMAGE=localhost:5000/net-monitor:v1
docker build -t $IMAGE https://github.com/wabbit-networks/net-monitor.git#main
docker push $IMAGE
notation cert generate-test --default --trust "wabbit-networks-dev"
notation sign --plain-http $IMAGE
notation list --plain-http $IMAGE
notation verify --plain-http $IMAGE

Signatures are persisted as ORAS Artifacts manifests.

For more detailed samples, see hello-signing

Core Documents

Community

Regular conversations for Notation occur on the Cloud Native Computing Slack channel.
Please see the CNCF Calendar for community meeting details.
Meeting notes are captured on hackmd.io.

Release Management

The Notation release process is defined in RELEASE_MANAGEMENT.md.

Support

Support for the Notation project is defined in supported releases.

Code of Conduct

This project has adopted the CNCF Code of Conduct. See CODE_OF_CONDUCT.md for further details.

License

This project is covered under the Apache 2.0 license. You can read the license here.

jondonas/notation