Notary

Notary is an open-source software supply chain security framework and specification hosted within the Cloud Native Computing Foundation (CNCF) that enables cryptographic signing, verification, and integrity validation of container images and software artifacts. Based on The Update Framework (TUF) specification and evolved through the Notary Project into Notary v2 (Notation), the project addresses the critical risk of tampering, malicious injection, and software artifact spoofing throughout continuous integration and deployment pipelines. By integrating digital signature mechanisms directly into OCI-compliant container registries, Notary allows developers and automated build pipelines to sign container images, software bills of materials (SBOMs), and provenance attestations using secure cryptographic keys or cloud-based hardware security modules. Downstream in the deployment lifecycle, Kubernetes admission controllers enforce automated signature verification policies, ensuring that only authenticated, untampered container artifacts signed by trusted organizational authorities are permitted to execute on production clusters. This robust verification workflow provides an immutable chain of custody from code compilation to cloud runtime, neutralizing unauthorized software modifications and supply chain compromises. Notary provides enterprise development and security teams with standardized cryptographic trust, auditability, and regulatory compliance across modern cloud-native architectures.