Notary Project: The Key To Secure Software Supply Chain
Talkat KubeCon + CloudNativeCon Europe 2025 · on Friday, 2025-04-04· at 13:45· Level 3 | ICC Capital Suite 14-16·
summary
Notary Project signs and verifies OCI artifacts and arbitrary blobs using the Notation CLI and a plugin model that plugs into AWS KMS, Azure Key Vault, Alibaba, HashiCorp Vault or HSMs; project runs security audits in 2022–2025 and supports JWS and COSE signatures plus a zero-dependency timestamping client. Enterprise practice implements multi-level promotion signatures (level 0/1/2 for build→QA→prod), uses plugin-based key backends for audited key use, and demonstrates signing and verification of SPDX blobs locally and after publish, which works in the demo.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:08What is Notary Project
- 6:48End-to-end workflow
- 8:56OnLogic's challenges
- 11:27Rules for attestation
- 13:20Why Notary over others
- 14:29Notation's extensibility
- 16:18Multi-level signing
- 18:49Why choose Notary Project
- 22:03Tools and libraries
- 23:52Project roadmap
- 25:32Demo: signing blob with Notation
- 28:05Q&A
related talks
40mNotary v2: Deep Dive and Open Issues
37mNotary: State Of Development
30mNotary v2: Supply Chain Security for Containers
32mNotary v2: Redesigning the Secure Supply Chain for Containers
35mNotary: State of the Container Supply Chain
31mSign, Attest, and Verify! A Practical Guide for Software Supply...
34mPolicy Compliance with Sigstore: From Signing Software to Validating the Whole Softwar...
39mKicking Security Chain Attacks to the Curb with Kyverno and Notary...