# notaryproject/notary

Notary is a project that allows anyone to have trust over arbitrary collections of data

Repository: https://github.com/notaryproject/notary
Canonical: https://ross.abutalabs.com/products/notary
Language: Go
License: Apache-2.0
License Family: permissive
Topics: docker, trust, cncf
Archived: true
Last push: 2024-08-07T19:02:32+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 4093, "days_push": 756, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: archived
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3286, forks 519 (observed 2026-08-28T04:07:53.767159+00:00)

## What it is
Notary is a Go implementation of The Update Framework (TUF), providing a client and server for signing and verifying trusted collections of data. It is best known as the engine behind Docker Content Trust, enabling publishers to sign content offline and consumers to verify integrity even against compromised servers or mirrors.

## Use cases
- sign and verify container images with docker content trust
- implement tuf-based software update security
- protect software distribution against server compromise
- manage signing keys with role-based key hierarchy
- verify integrity of published content from untrusted mirrors

## When to choose
- you need TUF-compliant signing and verification of software artifacts
- you use Docker Content Trust and need a notary server or client
- you want survivable key compromise and role-separated signing keys

## When to avoid
- you need the newer Notation/Notary v2 OCI signature ecosystem instead
- you only need simple checksum-based verification without key management
- you need a general-purpose artifact registry rather than a trust server

## Facets
- artifact type: application
- maturity: maintenance
- function: security, cryptography, cli, http-server
- domain: security, developer-tools
- platform: windows, go, self-hosted
- tags: tuf, content-trust, code-signing, supply-chain-security, docker-content-trust, cncf, containers, linux, macos, docker

## Member repositories
- notaryproject/notary (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:53.767159+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:22:55.398024+00:00, confidence not recorded.
  - readme: https://github.com/notaryproject/notary (fetched 2026-08-28T04:07:53.767159+00:00, sha b74c5e4dad72)
- Data as of 2026-08-30T08:39:29.467469+00:00.