Notary Project

Notary Project is an open-source specification and reference implementation for container image and artifact signing, verification, and trusted distribution in cloud-native supply chain security (software supply chain security).

• Defines specifications for signing and verifying container images and other artifacts (software supply chain security).
• Provides reference tooling and libraries for implementing signing and verification workflows (developer tooling).
• Integrates with container registries to store and retrieve signatures alongside artifacts (container registry integration).
• Supports policy-driven verification for artifact provenance and integrity enforcement (policy and governance).
• Aligns with CNCF’s cloud-native security ecosystem for securing software delivery pipelines (cloud-native security).

More About Notary Project

Notary Project addresses the problem of verifying the integrity and provenance of container images and related artifacts across cloud-native software supply chains (software supply chain security). It defines a specification for how signatures, certificates, and related metadata are created, stored, and discovered so that platforms, registries, and deployment systems can enforce that only authenticated and untampered artifacts are used in build and runtime environments.

The project provides specifications and reference implementations for signing and verifying container images and other OCI-compliant artifacts (container and artifact security). This includes formats and workflows for generating digital signatures, associating them with artifacts, and distributing those signatures via container registries. The specifications describe how clients discover signatures from registries and validate them using trusted keys or certificates, enabling automated integrity checks in Continuous Integration and Continuous Deployment (CI/CD) pipelines and runtime admission controls.

Within enterprise environments, Notary Project is used to enforce that artifacts deployed to clusters or edge locations originate from trusted build systems and have not been modified in transit (policy and governance). Platform teams integrate Notary-based verification into Continuous Integration (CI) systems, image promotion workflows, and Kubernetes admission controllers to block unsigned or untrusted artifacts. This supports compliance, auditability, and risk management requirements by providing verifiable chains of custody for software components.

Technically, Notary Project aligns with the OCI ecosystem and container registry protocols (cloud-native infrastructure). It defines ways to store signatures and related security metadata alongside artifacts in registries, reusing existing distribution mechanisms rather than requiring separate security services. The project is hosted by the Cloud Native Computing Foundation (CNCF), positioning it within a broader ecosystem of cloud-native runtime, orchestration, and security projects.

For interoperability, Notary Project focuses on clear specifications so that different registry implementations, signing tools, and verification clients can work together (interoperability standards). Enterprises can adopt reference clients and libraries or implement their own tools that conform to the specification while still interoperating with third-party registries and platforms. In a technical catalog or directory, Notary Project belongs under container and artifact signing, software supply chain security, and cloud-native registry-integrated security controls, providing a standard approach for verifiable artifact integrity and provenance across heterogeneous environments.