Which open source projects adopted Notation?

[MShekow]

I'm curious whether there are OSS projects that already use notation to sign their images.

For instance, I'm aware that Bitnami does this, see here.

Any other notable projects? A code search did not yield much.

[FeynmanZhou]

Hi @MShekow ,

You can find more OSS projects who adopted Notation on this page https://notaryproject.dev/docs/adopters/

[MShekow]

Thanks. I do know of that page; that's where I found the Bitnami link. However, I'm interested to know whether you know any other projects that sign with notation.

[FeynmanZhou]

Ratify is a fresh example who signed their images with notation: https://ratify.dev/docs/reference/security#signature-validation.

Notary Project focused more on the enterprise user scenario since its inception. Signing open-source release assets and images is the area that Notary Project community would like to improve in future releases. Do you have any ideas or requests on this scenario? I would be happy to help and cooperate with you on this scenario.

[MShekow]

Thanks for your openness. I'm asking because I'm writing a blog series about available options (including pros and cons) for signing and attesting images, targeting "DevOps engineers" who want to improve their supply-chain security. I'm covering solutions such as Notation, DCT, Cosign, GitHub attestations, and BuildKit attestations. I assume that the reader has questions like "How can I verify images built by others (typically open-source)" or "How can I sign my images? (which could be publicly or privately accessible)".

I also maintain a few smaller open-source projects, but I'm not part of any big projects.

If you're interested, I can send you previews of the main overview article and the article that covers Notation in more detail, to get your perspective. I could send those via LinkedIn messaging, for example.

[FeynmanZhou]

@MShekow Sure. I am interested in reviewing your blog post before publishing it. Please share it with me.