Skip to content

Releases: notaryproject/notation

v1.0.0

15 Aug 01:12
@github-actions github-actions
v1.0.0
This tag was signed with the committer’s verified signature.
shizhMSFT Shiwei Zhang
SSH Key Fingerprint: /USo+/l2qt5BGyRz/au8alBhetBI7qMvFrGJrnBg0kg Learn about vigilant mode.
80e3fc4
This commit was signed with the committer’s verified signature.
shizhMSFT Shiwei Zhang
SSH Key Fingerprint: /USo+/l2qt5BGyRz/au8alBhetBI7qMvFrGJrnBg0kg Learn about vigilant mode.
Compare
Choose a tag to compare
v1.0.0

Notation CLI V1

notation is a CLI reference implementation of the Notary Project Specifications v1.0.0 to sign and verify artifacts with signatures as standard items in the OCI registry ecosystem. After a long journey of development, notation has reached a notable milestone for its first stable release v1.0.0. 🎉🎉🎉

Important

Experimental features are intended for testing and evaluation purposes only and should not be used in production environments. Experimental features can be enabled by setting the environment variable NOTATION_EXPERIMENTAL=1.

Release blog posts of previous RC versions can be found at notaryproject.dev.

Key Features

Experimental Features

Security Audit

What's Changed Since RC.7

Bug Fixes

  • Fix #696: desktop.exe credential store is not supported in WSL
  • Fix #697: notation login fails to detect existing credentials for docker.io

Other Changes

  • Minor security improvements (#746)
  • Better code quality with more E2E tests cases
  • Better debug tracing
  • Dependency updates

Detailed Commits

  • fix(test): E2E test cases for OCI layout by @JeyJeyGao in #692
  • build(deps): Bump github.com/sirupsen/logrus from 1.9.2 to 1.9.3 by @dependabot in #702
  • fix: fix the issue with getting credentials for docker.io by @Wwwsylvia in #703
  • build(deps): Bump github.com/notaryproject/notation-go from 1.0.0-rc.3 to 1.0.0-rc.6 in /test/e2e/plugin by @dependabot in #710
  • fix: Updating documentation with AWS Plugin support by @priteshbandi in #711
  • fix: login and logout will leverage docker config and os default store by @Wwwsylvia in #712
  • chore: update issue templates by @yizha1 in #594
  • bump: bump oras-credentials-go v0.2.0 by @wangxiaoxuan273 in #717
  • build(deps): Bump golang.org/x/term from 0.8.0 to 0.9.0 by @dependabot in #716
  • fix(e2e): update testdata OCI layout images by @JeyJeyGao in #727
  • build(deps): Bump ossf/scorecard-action from 2.1.3 to 2.2.0 by @dependabot in #724
  • [StepSecurity] ci: Harden GitHub Actions for fixing Pinned-Dependencies by @step-security-bot in #731
  • [StepSecurity] ci: Harden GitHub Actions for fixing Token-Permissions by @step-security-bot in #730
  • build(deps): Bump oras.land/oras-go/v2 from 2.2.0 to 2.2.1 by @dependabot in #735
  • chore: add license header to files and github action workflow to check license by @Two-Hearts in #739
  • build(deps): Bump golang.org/x/term from 0.9.0 to 0.10.0 by @dependabot in #734
  • build(deps): Bump actions/checkout from 3.0.2 to 3.5.3 by @dependabot in #737
  • build(deps): Bump actions/add-to-project from 0da8e46333d7b6e01d0e857452a1e99cb47be205 to edc057aef96b993afe5d68104418f68a536264aa by @dependabot in #745
  • build(deps): Bump github/codeql-action from 2.20.1 to 2.20.4 by @dependabot in #742
  • fix: unset NOTATION_USERNAME and NOTATION_PASSWORD to avoid leaking credentials to plugin by @JeyJeyGao in #746
  • feat: add trace for executables by @wangxiaoxuan273 in #744
  • build(deps): Bump github.com/notaryproject/notation-core-go from 1.0.0-rc.4 to 1.0.0 by @dependabot in #752
  • build(deps): Bump github/codeql-action from 2.20.4 to 2.21.0 by @dependabot in #751
  • bump: upgrade notation-go to v1.0.0 by @shizhMSFT in #754
  • doc: update README to align with the new brand name by @FeynmanZhou in #750
  • bump: tag and release v1.0.0 by @shizhMSFT in #748

New Contributors

Full Changelog: v1.0.0-rc.7...v1.0.0

Contributors

priteshbandi, Wwwsylvia, and 8 other contributors
Assets 8
Loading

v1.0.0-rc.7

26 May 18:13
@github-actions github-actions
v1.0.0-rc.7
ebfb9ef
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.0.0-rc.7

🚀Notation CLI v1.0.0-rc.7 is now available!

Note: This release is identical to v1.0.0-rc.6 except that it contain's a e2e test bug fix.

What's Changed

Full Changelog: v1.0.0-rc.6...v1.0.0-rc.7

Assets 8
Loading

v1.0.0-rc.6

26 May 09:38
@github-actions github-actions
v1.0.0-rc.6
cc3f7aa
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.0.0-rc.6

🚀Notation CLI v1.0.0-rc.6 is now available!

What's Changed

  • doc: add link to README to docs for clarity by @zr-msft in #636
  • doc: improve error output in notation key and notation cert by @FeynmanZhou in #606
  • test: generate e2e coverage profile by @qweeah in #669
  • doc: update building guide by @JeyJeyGao in #563
  • fix: fixed global variable verifier by @Two-Hearts in #676
  • update: renamed flag --plain-http to --insecure-registry by @Two-Hearts in #674
  • chore: update account info for Patrick Zheng by @yizha1 in #672
  • build(deps): Bump github.com/sirupsen/logrus from 1.9.0 to 1.9.2 by @dependabot in #678
  • refactor: use oras-credentials-go for credential management by @Wwwsylvia in #654
  • chore: updated warning printout logic for Sign with --allow-referrers-api flag by @Two-Hearts in #682
  • test: add e2e test cases for flag --insecure-registry by @JeyJeyGao in #679
  • update: based on spec, updated messages of notation key command by @Two-Hearts in #684
  • fix: added digest check on resolve ref by @Two-Hearts in #689
  • build: bump up versions and dependencies by @priteshbandi in #685

Full Changelog: v1.0.0-rc.5...v1.0.0-rc.6

Contributors

qweeah, priteshbandi, and 7 other contributors
Assets 8
Loading

v1.0.0-rc.5

17 May 22:06
@github-actions github-actions
v1.0.0-rc.5
d850c3f
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.0.0-rc.5

🚀Notation CLI v1.0.0-rc.5 is now available!

What's Changed

New Contributors

Full Changelog: v1.0.0-rc.4...v1.0.0-rc.5

Contributors

priteshbandi, dependabot, and 3 other contributors
Assets 8
Loading

v1.0.0-rc.4

24 Apr 06:58
@github-actions github-actions
v1.0.0-rc.4
This tag was signed with the committer’s verified signature.
yizha1 Yi Zha
GPG key ID: D13855B9CC8E87FE
Learn about vigilant mode.
2e56dd4
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.0.0-rc.4

🚀Notation CLI v1.0.0-rc.4 is now available!

Features

  • Support validating certificate revocation with Online Certificate Status Protocol (OCSP)
  • Introduce switch NOTATION_EXPERIMENTAL=1 to enable experimental features
  • Introduce new CLI command notation policy to simplify trust policy configuration
  • Support OCI distribution referrers API
  • Introduce signing, listing and verification with OCI image layout as experimental feature
  • Experimental flag --signature-manifest for notation sign command is now controlled by switch NOTATION_EXPERIMENTAL=1

Other Changes

  • Support username and password prompt using notation login command
  • Bug fixes

Detailed Commits

New Contributors

Full Changelog: v1.0.0-rc.3...v1.0.0-rc.4

Contributors

qweeah, duffney, and 5 other contributors
Assets 8
Loading

v1.0.0-rc.3

07 Mar 14:33
@github-actions github-actions
v1.0.0-rc.3
This tag was signed with the committer’s verified signature.
yizha1 Yi Zha
GPG key ID: D13855B9CC8E87FE
Learn about vigilant mode.
233c0ea
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.0.0-rc.3

🚀Notation CLI v1.0.0-rc.3 is now available!

Notices

  • BREAKING CHANGE: The default type of signature manifest is changed to image manifest. The flag --signature-manifest for notation sign command is experimental for users to store signatures using artifact manifest.

New Features

  • notation sign command supports new flags to sign artifacts using on-demand keys
    • Example: notation sign --id <key_id> --plugin <key_vault_plugin> localhost:5000/net-monitor@sha256:xxx

Detailed Commits

New Contributors

Full Changelog: v1.0.0-rc.2.dev.20230226...v1.0.0-rc.3

Contributors

priteshbandi, kody-kimberl, and 2 other contributors
Assets 8
Loading

v1.0.0-rc.2.dev.20230226

26 Feb 16:04
@github-actions github-actions
v1.0.0-rc.2.dev.20230226
e47cf12
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.0.0-rc.2.dev.20230226 Pre-release
Pre-release

Notation Weekly Dev Build (2023-02-26T16:03:22Z)

Welcome to this Weekly Dev Build!

Changelog

Assets 8
Loading

v1.0.0-rc.2

17 Feb 01:06
@github-actions github-actions
v1.0.0-rc.2
5e2fa4a
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.0.0-rc.2

🚀Notation CLI v1.0.0-rc.2 is now available!

New Features

  • New command for users to inspect signatures associated with signed artifacts
    • Example: notation inspect localhost:5000/net-monitor@sha256:xxx
  • Support storing signatures in the registry using OCI image manifest
    • Example: notation sign --key mykey --signature-manifest image localhost:5000/net-monitor@sha256:xxx
  • Support adding user defined metadata to signature payload
    • Example: notation sign --key mykey --user-metadata io.wabbit-networks.buildTime=1672944615 localhost:5000/net-monitor@sha256:xxx

Other Changes

  • Introduced E2E testing framework and new E2E test cases
  • Add --debug and --verbose flags for more commands
  • Improved error messaging
  • Bug fixes

Detailed Commits

New Contributors

Full Changelog: v1.0.0-rc.1...v1.0.0-rc.2

Contributors

toddysm, priteshbandi, and 8 other contributors
Assets 8
Loading

v1.0.0-rc.1

07 Dec 15:56
@github-actions github-actions
v1.0.0-rc.1
5b52dc6
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.0.0-rc.1

🚀Notation CLI v1.0.0-rc.1 is now available! A tool to sign, store, and verify artifacts! Try it by following the quick start.

Notices

  • BREAKING CHANGE: Notation v1.0.0-rc.1 is not compatible with signatures signed by previous Notation releases.
  • BREAKING CHANGE: artifactType in signature manifest is changed to application/vnd.cncf.notary.signature
  • BREAKING CHANGE: Only support registries compliant with the OCI 1.1.0-rc2 image spec and OCI 1.1.0-rc1 distribution spec

Features

  • Sign artifacts using signing keys stored securely in remote key stores
  • Verify signatures using trust store and trust policy with fine-tuned configurations
  • Store signatures using OCI Artifact Manifest associated with signing artifacts in the registries compliant with the OCI 1.1.0-rc2 image spec and OCI 1.1.0-rc1 distribution spec
  • Support two signature envelope formats - JWS and COSE
  • Support use of plugins for signing and verification
  • Sign and verify using locally stored test keys/certificates for demonstration usage only
  • notation sign and notation verify commands support using --verbose and --debug flags for troubleshooting
  • Command sets in this release
    • notation sign: Sign OCI artifacts
      • Example: notation sign --key myKey localhost:5000/net-monitor@sha256:xxx
    • notation verify: Verify OCI artifacts
      • Example: notation verify localhost:5000/net-monitor@sha256:xxx
    • notation certificate: Manage certificates in trust store for verifying
      • Example: notation certificate add --type ca --store wabbit-networks wabbit-networks.crt
    • notation key: Manage keys used for signing
      • Example: notation key add mykey --plugin myKVplugin --id remoteKeyId
    • notation list: List signatures of the signed artifact
      • Example: notation list localhost:5000/net-monitor@sha256:xxx
    • notation login: Log in to a registry
      • Example: notation login registry.example.com -u username -p password
    • notation logout: Log out from a registry
      • Example: notation logout registry.example.com
    • notation plugin: Manage plugins
      • Example: notation plugin ls
    • notation version: Show the notation version information

Changes since last release

  • Store signatures using OCI Artifact Manifest associated with signing artifacts in the registries compliant with the OCI 1.1.0-rc2 image spec and OCI 1.1.0-rc1 distribution spec
  • notation sign and notation verify commands support using --verbose and --debug flags for troubleshooting
  • Improved output messages when tags are used to identify the artifacts
  • Updated CLI help doc
  • Pass expiry to envelope-generator plugin

Detailed Commits

New Contributors

Full Changelog: v0.12.0-beta.1...v1.0.0-rc.1

Contributors

toddysm, sajayantony, and 6 other contributors
Assets 8
Loading

v0.12.0-beta.1

02 Nov 06:04
@github-actions github-actions
v0.12.0-beta.1
965a0b7
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.12.0-beta.1

Features

  • Verify using trust store and trust policy
  • Manage trust store using CLI command notation certificate
  • Implement notation CLI command per CLI spec
  • Support configuration of signature format

Other changes

  • Clean up unused features and deprecated code

Changelog

  • 965a0b7 Updates for v0.12.0-beta.1 release (#427)
  • 24576db doc: remove reference to nv2 (#421)
  • 2fef168 build(deps): bump github.com/spf13/cobra from 1.6.0 to 1.6.1 (#425)
  • f0e77eb feat: Added notation certificate command for trust store (#405)
  • 8d1d4dc feat: add signatureFormat config field (#400)
  • fcba9f1 feat: implement list command UX (#414)
  • a08dc9e update: updated notation sign command based on spec (#417)
  • 2992190 update: updated notation key command based on spec (#416)
  • a41b377 feat: implement login/logout UX (#413)
  • 469069e update: updated notation verify command based on spec (#418)
  • a219ad5 feat: implement version command (#419)
  • 4d8da74 Fix demo docker pull step (#420)
  • eb87bc3 Change oras-project/registry tag (#397)
  • f947da5 feat: implement plugin UX (#415)
  • f747031 Bump github.com/spf13/cobra from 1.5.0 to 1.6.0 (#401)
  • 4803a8b spec: update notation cli md file as index for sub-commands (#374)
  • 193a533 spec: add CLI notation certificate and key specs (#361)
  • 01015b0 update: clean up notation CLI (#404)
  • ab20527 spec: add CLI specs for notation list/login/logout/plugin (#362)
  • 07bba5f spec: add spec for notation version command (#376)
  • ecb0708 spec: add spec for notation verify command (#371)
  • 20b9fa2 feat: use new verify workflow (#373)
  • eb7e4f4 update release process (#396)
  • 080c6bb doc: update doc after new release (#395)
Assets 8
Loading