Skip to content

Releases: notaryproject/notation

v1.0.0-rc.3

07 Mar 14:33
@github-actions github-actions
v1.0.0-rc.3
This tag was signed with the committer’s verified signature.
yizha1 Yi Zha
GPG key ID: D13855B9CC8E87FE
Learn about vigilant mode.
233c0ea
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.0.0-rc.3

🚀Notation CLI v1.0.0-rc.3 is now available!

Notices

  • BREAKING CHANGE: The default type of signature manifest is changed to image manifest. The flag --signature-manifest for notation sign command is experimental for users to store signatures using artifact manifest.

New Features

  • notation sign command supports new flags to sign artifacts using on-demand keys
    • Example: notation sign --id <key_id> --plugin <key_vault_plugin> localhost:5000/net-monitor@sha256:xxx

Detailed Commits

New Contributors

Full Changelog: v1.0.0-rc.2.dev.20230226...v1.0.0-rc.3

Contributors

priteshbandi, kody-kimberl, and 2 other contributors
Assets 8
Loading

v1.0.0-rc.2.dev.20230226

26 Feb 16:04
@github-actions github-actions
v1.0.0-rc.2.dev.20230226
e47cf12
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.0.0-rc.2.dev.20230226 Pre-release
Pre-release

Notation Weekly Dev Build (2023-02-26T16:03:22Z)

Welcome to this Weekly Dev Build!

Changelog

Assets 8
Loading

v1.0.0-rc.2

17 Feb 01:06
@github-actions github-actions
v1.0.0-rc.2
5e2fa4a
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.0.0-rc.2

🚀Notation CLI v1.0.0-rc.2 is now available!

New Features

  • New command for users to inspect signatures associated with signed artifacts
    • Example: notation inspect localhost:5000/net-monitor@sha256:xxx
  • Support storing signatures in the registry using OCI image manifest
    • Example: notation sign --key mykey --signature-manifest image localhost:5000/net-monitor@sha256:xxx
  • Support adding user defined metadata to signature payload
    • Example: notation sign --key mykey --user-metadata io.wabbit-networks.buildTime=1672944615 localhost:5000/net-monitor@sha256:xxx

Other Changes

  • Introduced E2E testing framework and new E2E test cases
  • Add --debug and --verbose flags for more commands
  • Improved error messaging
  • Bug fixes

Detailed Commits

New Contributors

Full Changelog: v1.0.0-rc.1...v1.0.0-rc.2

Contributors

toddysm, priteshbandi, and 8 other contributors
Assets 8
Loading

v1.0.0-rc.1

07 Dec 15:56
@github-actions github-actions
v1.0.0-rc.1
5b52dc6
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.0.0-rc.1

🚀Notation CLI v1.0.0-rc.1 is now available! A tool to sign, store, and verify artifacts! Try it by following the quick start.

Notices

  • BREAKING CHANGE: Notation v1.0.0-rc.1 is not compatible with signatures signed by previous Notation releases.
  • BREAKING CHANGE: artifactType in signature manifest is changed to application/vnd.cncf.notary.signature
  • BREAKING CHANGE: Only support registries compliant with the OCI 1.1.0-rc2 image spec and OCI 1.1.0-rc1 distribution spec

Features

  • Sign artifacts using signing keys stored securely in remote key stores
  • Verify signatures using trust store and trust policy with fine-tuned configurations
  • Store signatures using OCI Artifact Manifest associated with signing artifacts in the registries compliant with the OCI 1.1.0-rc2 image spec and OCI 1.1.0-rc1 distribution spec
  • Support two signature envelope formats - JWS and COSE
  • Support use of plugins for signing and verification
  • Sign and verify using locally stored test keys/certificates for demonstration usage only
  • notation sign and notation verify commands support using --verbose and --debug flags for troubleshooting
  • Command sets in this release
    • notation sign: Sign OCI artifacts
      • Example: notation sign --key myKey localhost:5000/net-monitor@sha256:xxx
    • notation verify: Verify OCI artifacts
      • Example: notation verify localhost:5000/net-monitor@sha256:xxx
    • notation certificate: Manage certificates in trust store for verifying
      • Example: notation certificate add --type ca --store wabbit-networks wabbit-networks.crt
    • notation key: Manage keys used for signing
      • Example: notation key add mykey --plugin myKVplugin --id remoteKeyId
    • notation list: List signatures of the signed artifact
      • Example: notation list localhost:5000/net-monitor@sha256:xxx
    • notation login: Log in to a registry
      • Example: notation login registry.example.com -u username -p password
    • notation logout: Log out from a registry
      • Example: notation logout registry.example.com
    • notation plugin: Manage plugins
      • Example: notation plugin ls
    • notation version: Show the notation version information

Changes since last release

  • Store signatures using OCI Artifact Manifest associated with signing artifacts in the registries compliant with the OCI 1.1.0-rc2 image spec and OCI 1.1.0-rc1 distribution spec
  • notation sign and notation verify commands support using --verbose and --debug flags for troubleshooting
  • Improved output messages when tags are used to identify the artifacts
  • Updated CLI help doc
  • Pass expiry to envelope-generator plugin

Detailed Commits

New Contributors

Full Changelog: v0.12.0-beta.1...v1.0.0-rc.1

Contributors

toddysm, sajayantony, and 6 other contributors
Assets 8
Loading

v0.12.0-beta.1

02 Nov 06:04
@github-actions github-actions
v0.12.0-beta.1
965a0b7
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.12.0-beta.1

Features

  • Verify using trust store and trust policy
  • Manage trust store using CLI command notation certificate
  • Implement notation CLI command per CLI spec
  • Support configuration of signature format

Other changes

  • Clean up unused features and deprecated code

Changelog

  • 965a0b7 Updates for v0.12.0-beta.1 release (#427)
  • 24576db doc: remove reference to nv2 (#421)
  • 2fef168 build(deps): bump github.com/spf13/cobra from 1.6.0 to 1.6.1 (#425)
  • f0e77eb feat: Added notation certificate command for trust store (#405)
  • 8d1d4dc feat: add signatureFormat config field (#400)
  • fcba9f1 feat: implement list command UX (#414)
  • a08dc9e update: updated notation sign command based on spec (#417)
  • 2992190 update: updated notation key command based on spec (#416)
  • a41b377 feat: implement login/logout UX (#413)
  • 469069e update: updated notation verify command based on spec (#418)
  • a219ad5 feat: implement version command (#419)
  • 4d8da74 Fix demo docker pull step (#420)
  • eb87bc3 Change oras-project/registry tag (#397)
  • f947da5 feat: implement plugin UX (#415)
  • f747031 Bump github.com/spf13/cobra from 1.5.0 to 1.6.0 (#401)
  • 4803a8b spec: update notation cli md file as index for sub-commands (#374)
  • 193a533 spec: add CLI notation certificate and key specs (#361)
  • 01015b0 update: clean up notation CLI (#404)
  • ab20527 spec: add CLI specs for notation list/login/logout/plugin (#362)
  • 07bba5f spec: add spec for notation version command (#376)
  • ecb0708 spec: add spec for notation verify command (#371)
  • 20b9fa2 feat: use new verify workflow (#373)
  • eb7e4f4 update release process (#396)
  • 080c6bb doc: update doc after new release (#395)
Assets 8
Loading

v0.11.0-alpha.4

14 Oct 09:59
@github-actions github-actions
v0.11.0-alpha.4
b9f1fb5
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.11.0-alpha.4

New Features

  • Support COSE signature envelope
  • Relax the certificate chain requirement to allow signing with self-signed certificates
  • Add CLI spec for notation sign
  • Add examples in CLI help doc for notation sign and verify commands

Bug fixes

  • Fix #313: deprecated the expiry flag of notation cert generate-test
  • Fix #332: fix broken links and refine wording in README.md

Other changes

  • Add weekly build for CI
  • Update to go 1.19
  • Update to oras-go 2.0.0-rc.3
  • Improve readability of documents and specs

Detail commits

Full Changelog: v0.10.0-alpha.3...v0.11.0-alpha.4

Contributors

dtzar, dependabot, and 6 other contributors
Assets 8
Loading

v0.10.0-alpha.3

18 Aug 11:49
@github-actions github-actions
v0.10.0-alpha.3
e73bfc3
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.10.0-alpha.3 Pre-release
Pre-release

New Features

  • Support notation login
  • Sign images with remote key stores that securely store the signing keys
  • Verify signatures using Trust Store configured in Notation clients
  • Sign images and verify signatures with locally stored test keys/certificates for demonstration use only
  • Setup Trust Store with the new directory-based structure
  • Configure Trust Policy as a JSON document. Support for registry scope and signature verification levels to customize the behavior during verification
  • Store signatures in registries compliant with the ORAS Artifacts Specification v1.0.0-RC.2

Bug Fixes

  • Fix #189: wrong download URL
  • Fix #264: hello-signing workflow with a self-generated certificate chain
  • Fix #286: allow empty credentials to store config

Removed

  • Remove docker-generate and docker-notation

Other Changes

  • Migrate to codecov.io
  • Add unit tests
  • Add CodeQL security scanning
  • Refactor: delete pkg/registry directory

Detail Commits

New Contributors

Full Changelog: v0.9.0-alpha.1...v0.10.0-alpha.3

Contributors

dtzar, rgnote, and 11 other contributors
Assets 8
Loading

v0.9.0-alpha.1

01 Jun 09:38
@github-actions github-actions
v0.9.0-alpha.1
7ff93cd
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.9.0-alpha.1 Pre-release
Pre-release

What's Changed

New Contributors

Full Changelog: v0.7.1-alpha.1...v0.9.0-alpha.1

Contributors

marcofranssen, dtzar, and 3 other contributors
Assets 8
Loading

feat-kv-extensibility

21 Jan 08:07
@SteveLasker SteveLasker
feat-kv-extensibility
17c7607
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
feat-kv-extensibility Pre-release
Pre-release

Notation supports remote signing, assuring the private keys used for the signing are kept private.
This release represents the work in progress for the pending Signing plugin interface API Spec #26 under the feat-kv-extensibility branch.

Installation

Each tar.gz file in the asset list contains multiple platform versions of the notation binaries built for a specific commit.

Install notation on Linux or WSL

# Choose a binary
timestamp=20220121081115
commit=17c7607

# Download, extract and install
curl -Lo notation.tar.gz https://github.com/notaryproject/notation/releases/download/feat-kv-extensibility/notation-feat-kv-extensibility-$timestamp-$commit.tar.gz
tar xvzf notation.tar.gz
tar xvzf notation_0.0.0-SNAPSHOT-${commit}_linux_amd64.tar.gz -C ~/bin notation

Install notation on Windows (Powershell)

# Choose a binary
$timestamp="20220121081115"
$commit="17c7607"

# Download and extract
curl.exe -Lo notation.tar.gz https://github.com/notaryproject/notation/releases/download/feat-kv-extensibility/notation-feat-kv-extensibility-$timestamp-$commit.tar.gz
tar.exe xvzf notation.tar.gz
Expand-Archive -Path notation_0.0.0-SNAPSHOT-${commit}_windows_amd64.zip
Assets 3
Loading

v0.7.1-alpha.1

19 Nov 14:32
@github-actions github-actions
v0.7.1-alpha.1
1608db2
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.7.1-alpha.1 Pre-release
Pre-release

Alpha 1 release of Notary v2 notation

Documentation 📘

  • Getting started with notation
  • Installing notation with linux and wsl2 
    curl -Lo notation.tar.gz https://github.com/notaryproject/notation/releases/download/v0.7.1-alpha.1/notation_0.7.1-alpha.1_linux_amd64.tar.gz
tar xvzf notation.tar.gz -C ~/bin notation

What's Changed

New Contributors

Full Changelog: v0.7.0-alpha.1...v0.7.1-alpha.1

Contributors

marcofranssen, sajayantony, and 3 other contributors
Assets 8
Loading