Notation review
A focused open-source choice for OCI, SBOM, and DevOps signing workflows.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Notation is an open-source command-line tool for signing and verifying OCI container images and other OCI artifacts, including software bills of materials. It is aimed at developers, DevOps teams, and software supply-chain operators that need artifact signatures to move through registries, CI/CD pipelines, or GitOps workflows. The project runs on Windows, macOS, and Linux, and stores signatures in OCI-compatible registries.
Its strongest fit is an ecosystem built around OCI artifacts and external signing services. Notation supports JWS and COSE formats, trust policies for verification, RFC 3161 trusted timestamping, and management of certificates, keys, plugins, and trust policies. Integrations include Azure Key Vault, AWS Signer, Venafi CodeSign Protect, GitHub Actions, Azure DevOps, and Flux. Plugins provide a path to connect external key stores and signing services rather than treating key management as a standalone hosted service.
Notation is a focused option for teams that want open-source tooling inside existing DevOps or GitOps processes. Its scope covers container images, SBOMs, and other OCI artifacts, with verification controls that suit software supply-chain workflows. Teams seeking a general-purpose code-signing platform or a hosted commercial certificate authority should choose a broader alternative. Teams comfortable with command-line workflows and responsible for their own signing-service, certificate, key, and trust-policy choices should find the feature set more relevant.
Notation pros and cons
- Where it wins
- Signs OCI images, other artifacts, and SBOMs
- Supports trust policies, timestamping, and OCI registries
- Connects with key stores, signing services, and CI/CD tools
- Where it doesn't
- Narrower scope than general-purpose code-signing platforms
- Does not provide a commercial signing certificate
- No hosted commercial certificate authority experience
Notation fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update