Skip to content

Commit

Permalink
Addressed misspellings and other feedback.
Browse files Browse the repository at this point in the history
Signed-off-by: Toddy Mladenov <toddysm@gmail.com>
  • Loading branch information
toddysm committed Jun 13, 2023
1 parent 8e25411 commit d02d9b8
Showing 1 changed file with 11 additions and 11 deletions.
22 changes: 11 additions & 11 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,16 +1,16 @@
# Notary Project Overview

The Notary Project is a set of specifications and tools intended to provide a cross-industry standard for securing software supply chains.
The Notary Project is a set of specifications and tools intended to provide a cross-industry standard for securing software supply chains through image signing and verification, signature portability, and key management.

The Notary Project started with an implementation for signing images in container registries and ensuring their integrity before deployment. The initial implementation uses [The Update Framework (TUF)](https://github.com/theupdateframework) and requires registries to host additional server infrastructure for managing signing keys and image metadata. This server infrstrcture tightly integrates with the container registry and keeps track of the images pushed to the registry. There is also a client component in the form of the `notary` command line interface (CLI) that can be used by developers or CI/CD pipelines to sign and push container images and update the metadata. The CLI wrapps the communication to the registry as well as to the key and metadata management server component. The most prominent use of this implementation is in Docker Content Trust (DCT). The server and the client implementation can be found in the [notary](https://github.com/notaryproject/notary) repository under the Notary Project organization.
The Notary Project started with an implementation for signing images in container registries and ensuring their integrity before deployment. The initial implementation uses [The Update Framework (TUF)](https://github.com/theupdateframework) and requires registries to host additional server infrastructure for managing signing keys and image metadata. This server infrastrcture tightly integrates with the container registry and keeps track of the images pushed to the registry. There is also a client component in the form of the `notary` command line interface (CLI) that can be used by developers or CI/CD pipelines to sign and push container images and update the metadata. The CLI wraps the communication to the registry as well as to the key and metadata management server component. The most prominent use of this implementation is in Docker Content Trust (DCT). The server and the client implementation can be found in the [notary](https://github.com/notaryproject/notary) repository under the Notary Project organization.

Due to the tight integration between the registry and the key and metadata management server component, portability of signatures between registries is limited. This also limits the portability of the container images. Also, container registry APIs are getting standardized under the [Open Containers Initiative (OCI)](https://github.com/opencontainers) and new capabilities are added. To overcome the portability challenges and enable future flexibility and standardization, the Notary Project community decided to concentrate on specifications for software supply chains and provide reference implementations.

The first specification from the Notary Project is the [signature specification](https://github.com/notaryproject/notaryproject/blob/main/specs/signature-specification.md) that specifies how portable signatures wrapped in [COSE](https://github.com/notaryproject/notaryproject/blob/main/specs/signature-envelope-cose.md) or [JWS](https://github.com/notaryproject/notaryproject/blob/main/specs/signature-envelope-jws.md) envelopes can be produced. The specification defines the [signing and verification workflow](https://github.com/notaryproject/notaryproject/blob/main/specs/signing-and-verification-workflow.md) (aka _Notary signing and verification_), the [signing scheme](https://github.com/notaryproject/notaryproject/blob/main/specs/signing-scheme.md), the signature format and how to wrap the signature using COSE or JWS envelopes. A signature, also called a _Notary signature_, produced according to the Notary signature specification can be copied between OCI registries and validated in connected, occasionally connected, and disconnected environments without the need of additional server insfrastructure. The Notary signature secification is available in the [notaryproject](https://github.com/notaryproject/notaryproject/tree/main/specs) repository under the Notary Project.
The first specification from the Notary Project is the [signature specification](https://github.com/notaryproject/notaryproject/blob/main/specs/signature-specification.md) that specifies how portable signatures wrapped in [COSE](https://github.com/notaryproject/notaryproject/blob/main/specs/signature-envelope-cose.md) or [JWS](https://github.com/notaryproject/notaryproject/blob/main/specs/signature-envelope-jws.md) envelopes can be produced. The specification defines the [signing and verification workflow](https://github.com/notaryproject/notaryproject/blob/main/specs/signing-and-verification-workflow.md) (aka _Notary signing and verification_), the [signing scheme](https://github.com/notaryproject/notaryproject/blob/main/specs/signing-scheme.md), the signature format and how to wrap the signature using COSE or JWS envelopes. A signature, also called a _Notary signature_, produced according to the Notary signature specification can be copied between OCI registries and validated in connected, occasionally connected, and disconnected environments without the need of additional server insfrastructure. The Notary signature specification is available in the [notaryproject](https://github.com/notaryproject/notaryproject/tree/main/specs) repository under the Notary Project.

The [notaryproject](https://github.com/notaryproject/notaryproject/) repository also contains information about the [requirements and scenarios](https://github.com/notaryproject/notaryproject/tree/main/requirements) that the Notary Project supports or plans to support as well as the [reports from security testing and audits](https://github.com/notaryproject/notaryproject/tree/main/security).

A reference implementation for the Notary signature in Golang is provided in the [`notation-core-go`](https://github.com/notaryproject/notation-core-go) library. A convenience Golang library that interacts with OCI registries and manages the relation between a signed artifact and a signature is provided in the [`notation-go`](https://github.com/notaryproject/notation-go) library. `notation-go` provides an easy way to implement the Notary signing and verification in Golang. The convenience library is also used by the [`notation` CLI](https://github.com/notaryproject/notation) that can be used by developers and CI/CD pipelines to produce portable signatures and store them together with the signed artifacts in OCI-compliant registries. The `notation` CLI implements the Notary signing and verification and can also be used to verify signatures of artifacts stored in OCI-compliant registries.
A reference implementation for the Notary signature in Golang is provided in the [`notation-core-go`](https://github.com/notaryproject/notation-core-go) library. A convenient Golang library that interacts with OCI registries and manages the relation between a signed artifact and a signature is provided in the [`notation-go`](https://github.com/notaryproject/notation-go) library. `notation-go` provides an easy way to implement the Notary signing and verification in Golang. The convenient library is also used by the [`notation` CLI](https://github.com/notaryproject/notation) that can be used by developers and CI/CD pipelines to produce portable signatures and store them together with the signed artifacts in OCI-compliant registries. The `notation` CLI implements the Notary signing and verification and can also be used to verify signatures of artifacts stored in OCI-compliant registries.

You can learn more about the Notary Project on the [notaryproject.dev](https://notaryproject.dev) website.

Expand All @@ -22,18 +22,18 @@ Here is a list of repositories under the Notary Project organization
| ----- | -----|
| [.github](https://github.com/notaryproject/.github) | This repository contains the Notary Project governance and other common documents that are shared across repositories. |
| [meeting-notes](https://github.com/notaryproject/meeting-notes) | This repository contains the archived meeting notes. |
| [notary](https://github.com/notaryproject/notatry) | This repository contains the source code for the server and the client of the TUF-based implementation. |
| [notaryproject](https://github.com/notaryproject/notatryproject) | This repository contains the Notary Project requirements, scenarios, specifications, and security audits. |
| [notaryproject.dev](https://github.com/notaryproject/notatryproject.dev) | This repository contains the source code and content for the [Notary Project website](https://notaryproject.dev). |
| [notation](https://github.com/notaryproject/notation) | This repository contains the source code for the convenience CLI implementation of the Notary signing and verification flow. |
| [notation-go](https://github.com/notaryproject/notation-go) | This repository contains the source code for the convenience Golang library implementation of the Notary signing and verification flow. |
| [notary](https://github.com/notaryproject/notary) | This repository contains the source code for the server and the client of the TUF-based implementation. |
| [notaryproject](https://github.com/notaryproject/notaryproject) | This repository contains the Notary Project requirements, scenarios, specifications, and security audits. |
| [notaryproject.dev](https://github.com/notaryproject/notaryproject.dev) | This repository contains the source code and content for the [Notary Project website](https://notaryproject.dev). |
| [notation](https://github.com/notaryproject/notation) | This repository contains the source code for the convenient CLI implementation of the Notary signing and verification flow. |
| [notation-go](https://github.com/notaryproject/notation-go) | This repository contains the source code for the convenient Golang library implementation of the Notary signing and verification flow. |
| [notation-core-go](https://github.com/notaryproject/notation-core-go) | This repository contains the source code for the Golang library implementation of the Notary signature specification and wrapping (COSE and JWS). |
| [roadmap](https://github.com/notaryproject/roadmap) | This repository is intended for keeping track of development activitis in the Notary project. It may be retired in the future. |
| [roadmap](https://github.com/notaryproject/roadmap) | This repository is intended for keeping track of development activities in the Notary Project. It may be retired in the future. |
| [tuf](https://github.com/notaryproject/tuf) | This repository is intended for prototyping the storage of TUF metadata in OCI-compliant registries. It is not under active development at the moment but there are plans to revive it in the future. |

## Project Status

The Notary Project is in active development. The latest release announcement are published on the [Notary Project blog](https://notaryproject.dev/blog/). The Notary community uses the [project board](https://github.com/orgs/notaryproject/projects/10) for project planning and status tracking. You can also use GitHub milestones to track the progress of each repository:
The Notary Project is in active development. The latest release announcements are published on the [Notary Project blog](https://notaryproject.dev/blog/). The Notary community uses the [project board](https://github.com/orgs/notaryproject/projects/10) for project planning and status tracking. You can also use GitHub milestones to track the progress of each repository:

- [The Notary Project specification milestones](https://github.com/notaryproject/notaryproject/milestones)
- [notation CLI milestones](https://github.com/notaryproject/notation/milestones)
Expand Down

0 comments on commit d02d9b8

Please sign in to comment.