macOS
Homebrewvérifié · 100%
brew install notationlocal Homebrew formula metadata
brew
Installer notation avec Homebrew, Nix, winget
Consultez les chemins d'installation, exécutables, métadonnées et notes de sécurité de notation pour les workflows d'agents IA.
installation
Commandes d'installation supplémentaires
Linux
Nixvérifié · 92%
nix profile install nixpkgs#notationnixpkgs package indexes · pkgs/by-name/no/notation/package.nix · Source: api.github.com
Windows
Windows Package Managervérifié · 92%
winget install --id NotaryProject.Notation -eWindows Package Manager source index · NotaryProject.Notation · Source: cdn.winget.microsoft.com
aperçu
Résumé du paquet
CLI tool to sign and verify OCI artifacts and container images
Liens du projet
Commandes et alias
- notation
historique
Historique du projet et usages
Notation is the Notary Project command-line implementation for signing and verifying OCI artifacts and container images. Its role is narrower than a general packaging or registry client: it exists to put signatures into the OCI registry ecosystem and to enforce trust policy when artifacts are pulled or promoted.
Historique du projet
The public tag history for notaryproject/notation starts with v0.7.0-alpha.1 on 2021-10-20, followed by a long alpha and release-candidate line before the first stable v1.0.0 release on 2023-08-15. The v1.0.0 release notes describe it as the CLI reference implementation of the Notary Project Specifications v1.0.0 and call out signing, verification, signature inspection, registry authentication through Docker credential stores, plugin support, trust policy, trust stores, and certificate revocation support.
The project sits inside the broader Notary Project, which is a CNCF Incubating project. That matters for adoption because Notation is not just a standalone CLI: it is tied to a standards-oriented supply-chain security effort around OCI registries and signatures.
Historique d'adoption
Adoption is strongest in container supply-chain security workflows rather than general developer CLI usage. The README points users at quickstarts for signing and validating container images and at cloud-provider integrations such as Azure Key Vault and AWS Signer. Homebrew analytics are modest, with 256 installs over the 365-day window reported by the formula JSON, which fits a specialized security tool rather than a broad daily shell utility.
Modes d'utilisation
Package nerds use notation where signatures need to be attached to images or other OCI artifacts and then verified by policy. The practical loop is: authenticate to a registry, sign an artifact, inspect or list signatures, configure trust stores and trust policy, and verify before promotion or deployment. Plugin support is important because signing keys often live in KMS systems rather than local files.
Pourquoi les passionnés de paquets s'y intéressent
Notation is significant because it is one of the concrete tools package and registry people reach for when discussing OCI-native signatures. Its value is less about command-line ergonomics and more about being the executable face of the Notary Project specifications.
Chronologie
- 2021-10-20: v0.7.0-alpha.1 tag in the public repository.
- 2023-08-15: v1.0.0 release announced as the first stable Notation CLI V1 release.
- 2025-04-24: v1.3.2 tag, the stable version packaged by Homebrew in the checked formula metadata.
- 2025-03-12: v2.0.0-alpha.1 tag appeared, showing active work beyond the 1.x line.
Related projects
- Notary Project specifications, OCI image/distribution specifications, ORAS, Docker credential stores, Azure Key Vault, AWS Signer.
Sources
posture de sécurité
Niveau de risque : orange
broad file, network, media, or database tool signal. infrastructure mutation or orchestration signal.
Classificateur de risque
risque orange · confiance moyen · infrastructure
Pourquoi
- broad file, network, media, or database tool signal
- infrastructure mutation or orchestration signal
Signaux
- text:container
- text:image
Comportement d'installation
- Aucun hook post-install Homebrew n’est enregistré dans les métadonnées de formule.
- Les métadonnées de bottle Homebrew sont disponibles pour 6 plateformes.
- Les métadonnées de compilation listent 1 dépendances de compilation.
Revue recommandée
Avant une utilisation sans surveillance par un agent, vérifiez si l'outil lit des identifiants en clair, écrit un état distant, publie des artefacts ou lance des plugins.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Configuration files
Config paths the tool may read or write during local use.
- Linux
~/.config/notation/config.json- macOS
~/Library/Application Support/notation/config.json- Windows
~/AppData/Roaming/notation/config.json
Credential files
Credential-bearing paths to review before unattended agent runs.
- Linux
~/.config/notation/config.json~/.config/notation/signingkeys.json~/.docker/config.json- macOS
~/Library/Application Support/notation/config.json~/Library/Application Support/notation/signingkeys.json~/.docker/config.json- Windows
~/AppData/Roaming/notation/config.json~/AppData/Roaming/notation/signingkeys.json
exécutables
Exécutables installés
| Commande | Type | Exposition | Note |
|---|---|---|---|
notation | cli | exécutable global |
fraîcheur
Version et fraîcheur
Ces signaux séparent l'âge de génération de la page, l'activité du gestionnaire de paquets et la comparaison avec les versions amont. Un retard de version n'est signalé que lorsqu'une URL de preuve et des versions comparables sont présentes.
page générée2026-07-25
version du gestionnaire1.3.2
gestionnaire mis à jour
données localesOK
amontà jour
dernière version détectéev1.3.2
https://github.com/notaryproject/notation
- infoNo package-manager update timestamp was available.confiance faible
métadonnées d'installation
Métadonnées du paquet
| Clé du paquet | brew:notation |
|---|---|
| Version | 1.3.2 |
| Gestionnaire de paquets | Homebrew |
| Page du gestionnaire de paquets | https://formulae.brew.sh/formula/notation |
| Page d'accueil | https://notaryproject.dev/ |
| Dépôt | https://github.com/notaryproject/notation |
| Docs amont | https://github.com/notaryproject/notation#readme |
| Licence | Apache-2.0 |
| Archive source | https://github.com/notaryproject/notation/archive/refs/tags/v1.3.2.tar.gz |
| Dépendances de compilation | go |
| Bouteille | disponible (sur arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| post-install Homebrew | non défini |
| Service | aucun déclaré |
faits du registre
Détails de la base source
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | notation |
| Version Scheme | 0 |
| Revision | 0 |
| Head Version | HEAD |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
correspondances dans les bases sources
Autres enregistrements de gestionnaires de paquets
Les correspondances proviennent d’index externes de gestionnaires de paquets et restent séparées des liens de paquets Automic Vault locaux.
Nix95%
notation
nix profile install nixpkgs#notation- normalized package name match
- Correspondance par : Notation
winget95%
NotaryProject.Notation
winget install --id NotaryProject.Notation -e- normalized package name match
- Correspondance par : Notation
piste source
Généré depuis les données du dépôt
Cette page est servie par av-web depuis l'artéfact SQLite privé des paquets généré par scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Sources utilisées
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated configuration and credential file locations
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment