Notation
Notation: A focused open-source choice for OCI, SBOM, and DevOps signing workflows. Ranked #16 of 28 in Code Signing Software by our editors (7.4/10); pricing: Open source; best for OCI and SBOM signing in DevOps workflows.
At a glance
- Editor score7.4 / 10
- PricingOpen source
- Best forOCI and SBOM signing in DevOps workflows
- Paid fromFree
- Supported targetsOCI container images and other OCI artifacts, including SBOMs
- Facts checked20 Sep 2026
Where it wins
- Signs OCI images, other artifacts, and SBOMs
- Supports trust policies, timestamping, and OCI registries
- Connects with key stores, signing services, and CI/CD tools
Where it doesn't
- Narrower scope than general-purpose code-signing platforms
- Does not provide a commercial signing certificate
- No hosted commercial certificate authority experience
Our verdict on Notation
Notation is an open-source command-line tool for signing and verifying OCI container images and other OCI artifacts, including software bills of materials. It is aimed at developers, DevOps teams, and software supply-chain operators that need artifact signatures to move through registries, CI/CD pipelines, or GitOps workflows. The project runs on Windows, macOS, and Linux, and stores signatures in OCI-compatible registries.
Its strongest fit is an ecosystem built around OCI artifacts and external signing services. Notation supports JWS and COSE formats, trust policies for verification, RFC 3161 trusted timestamping, and management of certificates, keys, plugins, and trust policies. Integrations include Azure Key Vault, AWS Signer, Venafi CodeSign Protect, GitHub Actions, Azure DevOps, and Flux. Plugins provide a path to connect external key stores and signing services rather than treating key management as a standalone hosted service.
Notation is a focused option for teams that want open-source tooling inside existing DevOps or GitOps processes. Its scope covers container images, SBOMs, and other OCI artifacts, with verification controls that suit software supply-chain workflows. Teams seeking a general-purpose code-signing platform or a hosted commercial certificate authority should choose a broader alternative. Teams comfortable with command-line workflows and responsible for their own signing-service, certificate, key, and trust-policy choices should find the feature set more relevant.
Your product? Our editors can test Notation in depth and publish a review, labelled as paid · from $149/mo →
Notation pricing
Notation fact sheet
| Free plan | Not verified |
|---|---|
| Paid from | Free |
| Supported targets | OCI container images and other OCI artifacts, including SBOMs |
| Certificate provided | No |
| Cloud signing | Yes |
| HSM key protection | Not verified |
| Trusted timestamping | Yes |
| CI/CD signing | Yes |
| Approval workflows | Not verified |
| Deployment | Self-hosted |
| Platforms | Windows, macOS, Linux |
| Support | Community, Docs |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 6 integrations: Azure Key Vault, AWS Signer, Venafi CodeSign Protect, GitHub Actions, Azure DevOps, Flux |
| Pricing | Open source |
| Website | notaryproject.dev |
| Facts checked | 20 Sep 2026 |
Notation integrations
Notation lists 6 integrations on its own site.
- Azure Key Vault
- AWS Signer
- Venafi CodeSign Protect
- GitHub Actions
- Azure DevOps
- Flux
Alternatives to Notation
- SignPathGoverned signing for teams shipping software across diverse artifact formats.9.4
- DigiCert Software Trust ManagerEnterprise signing governance for artifacts, approvals, keys, and release pipelines.9.2
- SignServerA flexible open-source signing server with enterprise controls for production deployments.9.0
See all Notation alternatives →
Used Notation? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Notation for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Notation is listed in our Code Signing Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/notation/"><img src="https://www.itechguides.com/best/badge/notation.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update