Skip to content

Commit 40fbf7a

Browse files
paulsavoiepaulsavoie
authored
Merge pull request #48 from SignPath/SP_1.210
Sp 1.210
2 parents e4b62cb + 0fcb366 commit 40fbf7a

15 files changed

Lines changed: 568 additions & 186 deletions

File tree

‎docs/_data/changelog.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,20 @@
1+
- date: '2026-04-27'
2+
updates:
3+
application:
4+
version: 1.210.0
5+
new_features:
6+
- text: |-
7+
Added support for [Notary](/artifact-configuration/reference#notation-sign) and [Cosign](/artifact-configuration/reference#cosign-sign) container signatures.
8+
issues: [SIGN-7799, SIGN-7653, SIGN-7652, SIGN-7655, SIGN-7798, SIGN-7654, SIGN-8303, SIGN-8319, SIGN-8292, SIGN-8365, SIGN-8361]
9+
self_hosted_installations:
10+
version: 1.210.0
11+
improvements:
12+
- text: |-
13+
Improved reliability when database outages happen during the upgrade migration process.
14+
issues: [SIGN-8493]
15+
- text: |-
16+
Improved performance for signing request list UI and REST API calls.
17+
issues: [SIGN-8495]
118
- date: '2026-04-22'
219
updates:
320
github_actions_action:
@@ -154,6 +171,7 @@
154171
new_features:
155172
- text: The Crypto Providers are now available via stable links on our download share. See the [download section](/crypto-providers#download) for details.
156173
issues: [SIGN-8265]
174+
- text: Initial Release of the [SignPath Notation plugin](/crypto-providers/notation).
157175
teamcity_plugin:
158176
version: 0.5.0
159177
improvements:

‎docs/_data/menus/documentation.yml‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,6 @@
1515

1616
- text: Signing Container Images
1717
path: signing-containers
18-
items:
19-
- text: Sigstore Cosign
20-
path: cosign
21-
22-
- text: Docker Content Trust (DCT)
23-
path: docker-content-trust
2418

2519
- separator: true
2620

@@ -92,6 +86,9 @@
9286
- text: macOS CryptoTokenKit
9387
path: macos
9488

89+
- text: Notation
90+
path: notation
91+
9592
- text: REST API
9693
path: rest-api
9794

‎docs/_data/tables/artifact-configuration.yml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,13 @@ signing-file-elements:
105105
directive: "[`<xml-sign>`](#xml-sign)"
106106
extensions: ".xml"
107107
description: "Use this directive to sign XML files using [XMLDSIG](https://www.w3.org/TR/xmldsig-core1/) (available for Advanced Code Signing). File size limit: 2 MB."
108+
- element: "`<oci-image-layout-archive-file>`"
109+
isComposite: "No"
110+
directive: |
111+
[`<notation-sign>`](#notation-sign),
112+
[`<cosign-sign>`](#cosign-sign)
113+
extensions: '.tar'
114+
description: "Sign [container images](/signing-containers) uploaded in an OCI layout file."
108115
- element: "[`<directory>`](syntax#directory-element)"
109116
isComposite: "Yes"
110117
directive: "[`<clickonce-sign>`](#clickonce-sign)"
@@ -142,7 +149,9 @@ signing-method-categories:
142149
[`<jar-sign>`](#jar-sign),
143150
[`<apk-sign>`](#apk-sign),
144151
[`<office-macro-sign>`](#office-macro-sign),
145-
[`<xml-sign>`](#xml-sign)
152+
[`<xml-sign>`](#xml-sign),
153+
[`<notation-sign>`](#notation-sign),
154+
[`<cosign-sign>`](#cosign-sign)
146155
- category: "[Enveloped](#enveloped-signing-methods)"
147156
description: Adds a new file that contains the unsigned file _and_ the signature.
148157
original: Preserved

‎docs/_data/tables/signing-containers.yml‎

Lines changed: 144 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,151 @@
1-
methods-differences:
1+
methods-comparison:
22
headers:
33
topic:
4-
cosign: Sigstore Cosign
4+
notary: Notary (Notation)
5+
cosign_fulcio: Cosign (with Fulcio)
6+
cosign_keys: Cosign (Public/Private Keys)
57
dct: Docker Content Trust (DCT)
8+
gpg: GPG
69
_attributes:
7-
topic: {style: "width: 16%"}
8-
cosign: {style: "width: 42%"}
9-
dct: {style: "width: 42%"}
10+
topic: { style: "width:15%" }
11+
notary: { style: "width:17%" }
12+
cosign_fulcio: { style: "width:17%" }
13+
cosign_keys: { style: "width:17%" }
14+
dct: { style: "width:17%" }
15+
gpg: { style: "width:17%" }
1016
body:
11-
- topic: OCI Registry Requirements
12-
cosign: Works with any OCI registry.
13-
dct: Requires [Notary](https://github.com/notaryproject/notary) server and signer (provided by _some_ OCI registries including Docker Hub and Azure Container Registry).
14-
- topic: Validation Support
15-
cosign: |
16-
* Sigstore [Kubernetes Policy Controller](https://docs.sigstore.dev/policy-controller/overview/)
17-
* [Connaisseur Cosign validator](https://sse-secure-systems.github.io/connaisseur/v3.3.2/validators/sigstore_cosign/) (third-party OSS)
18-
dct: |
19-
* [Docker CLI](https://docs.docker.com/engine/security/trust/)
20-
* [Mirantis Kubernetes Engine (MKE)](https://docs.mirantis.com/containers/v3.0/dockeree-products/msr/msr-user/manage-images/sign-images/trust-with-a-remote-mke.html)
21-
* [Connaisseur DCT validator](https://sse-secure-systems.github.io/connaisseur/v3.3.2/validators/notaryv1/) (third-party OSS)
22-
* [trusted-compose](https://github.com/sse-secure-systems/trusted-compose) for Docker Compose (third party OSS)
23-
- topic: Ecosystem
24-
cosign: |
25-
Integrated with other Sigstore components including
26-
* [Fulcio](https://docs.sigstore.dev/certificate_authority/overview/), an OpenID-based certificate authority
27-
* [Rekor](https://docs.sigstore.dev/logging/overview/), a transparency log
17+
- topic: Recommended for
18+
notary: Enterprises
19+
cosign_fulcio: Open source projects
20+
cosign_keys:
21+
dct:
22+
gpg: Podman
23+
- _header: Overview
24+
- topic: Advantages
25+
notary: |
26+
* Simple setup
27+
* Uses existing X.509 PKI infrastructure
28+
* Mature trust model
29+
* Recommended by Microsoft and Amazon
30+
cosign_fulcio: |
31+
* Existing infrastructure for open-source projects
32+
* Public transparency log (optional)
33+
* Podman support (public key only)
34+
cosign_keys: |
35+
* Public transparency log (optional)
36+
dct:
37+
gpg: |
38+
* Podman support
39+
- topic: Disadvantages
40+
notary:
41+
cosign_fulcio: |
42+
* Verification only using repository and/or email addresses
43+
* Signing without the public transparency log is discouraged
44+
cosign_keys: |
45+
* Verification only with public keys or special X.509 certificates
46+
* Signing without the public transparency log is discouraged
2847
dct: |
29-
Based on
30-
* [The Update Framework (TUF)](https://theupdateframework.io/), an opinionated framework for code signing
31-
* [Notary](https://github.com/notaryproject/notary), an online implementation of TUF
32-
- topic: Industry Support
33-
cosign: |
34-
* Excellent adoption by OSS projects
48+
* Security concern: potential history rewrite
49+
* No stable support in AKS
50+
* Complex setup
51+
* Legacy (no active development)
52+
gpg: |
53+
* Signature is not transferrable between registries
54+
* Signature has to be provided out-of-band
55+
- _header: 'Feature Support'
56+
- topic: Transfer signatures between registries
57+
notary: 'Yes'
58+
cosign_fulcio: 'Yes'
59+
cosign_keys: 'Yes'
60+
dct: 'No'
61+
gpg: 'No'
62+
- topic: Non-container artifacts
63+
notary: 'Yes'
64+
cosign_fulcio: 'Yes'
65+
cosign_keys: 'Yes'
66+
dct: 'No'
67+
gpg: 'No'
68+
- topic: Timestamping
69+
notary: Yes (RFC 3161)
70+
cosign_fulcio: Yes (through Rekor transparency log)
71+
cosign_keys: Yes (through Rekor transparency log)
72+
dct: Yes (through Notary "freshness")
73+
gpg: 'No'
74+
- topic: Invalidating signatures
75+
notary: Yes (X.509 certificate revocation)
76+
cosign_fulcio: Yes (Rekor log update)
77+
cosign_keys: Yes (Rekor log update)
78+
dct: Yes (via TUF)
79+
gpg: 'No'
80+
- topic: In-House X.509 PKI
81+
notary: 'Yes'
82+
cosign_fulcio: No (only with dedicated Fulcio server)
83+
cosign_keys: 'No'
84+
dct: 'No'
85+
gpg: 'No'
86+
- topic: Air-gapped systems
87+
notary: 'Yes'
88+
cosign_fulcio: 'No'
89+
cosign_keys: 'Yes'
90+
dct: 'No'
91+
gpg: 'Yes'
92+
- _header: Security attributes
93+
- topic: Trust model
94+
notary: PKI, X.509
95+
cosign_fulcio: Sigstore (Fulcio, Rekor)
96+
cosign_keys: Public/Private Keys
97+
dct: Notary v1, TUF
98+
gpg: GPG Public Keys
99+
- topic: Root of trust
100+
notary: Root Certificate (X.509)
101+
cosign_fulcio: OpenID Connect Issuer via Fulcio
102+
cosign_keys: Public Key
103+
dct: Trust on first use
104+
gpg: GPG Keyring
105+
- topic: Root key security
106+
notary: Secure with SignPath
107+
cosign_fulcio: Sigstore.dev (public Fulcio instance) keeps keys secure via TUF
108+
cosign_keys: n/a
109+
dct: Only file-based root key support
110+
gpg: Via GPG ecosystem
111+
- topic: Signing key security
112+
notary: Secure with SignPath
113+
cosign_fulcio: None (short-lived client side keys)
114+
cosign_keys: Secure with SignPath
115+
dct: Secure with SignPath
116+
gpg: Secure with SignPath
117+
- _header: Validation support
118+
- topic: Kubernetes admission controllers
119+
notary: Ratify for K8s (recommended by AWS and Azure)
120+
cosign_fulcio: Sigstore, Ratify, Connaisseur (public key only)
121+
cosign_keys: Sigstore, Ratify, Connaisseur
122+
dct: Connaisseur
123+
gpg: Only podman
124+
- topic: Required infrastructure
125+
notary: |
126+
* OCI-compliant container registry
127+
cosign_fulcio: |
128+
* Fulcio CA
129+
* Rekor transparency log (optional)
130+
* OCI-compliant registry
131+
cosign_keys: |
132+
* OCI-compliant Container registry
35133
dct: |
36-
* Intially proposed by Docker (but never quite picked up)
37-
* [Notation](https://github.com/notaryproject/specifications) (a.k.a. Notary 2) is supposed to eventually succeed DCT
134+
* Docker registry
135+
* Notary server
136+
gpg: Podman runtime (no aditionl requirements)
137+
- topic: Verification policy settings
138+
notary: |
139+
* Trusted root certificates
140+
* Trusted timestamping certificates
141+
* X.509 certificate fields
142+
cosign_fulcio: |
143+
* OpenID Connect issuer
144+
* Subject
145+
cosign_keys: |
146+
* Key pinning
147+
dct: |
148+
* Key pinning
149+
gpg: |
150+
* Key pinning (per repository or registry)
151+

‎docs/_includes/container_image_reference_panel.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{:.panel.info}
2+
> **Image references**
3+
>
4+
> An **image reference** consists of the following parts:
5+
> * Optionally, the registry host and port, e.g. `docker.io` or `registry.mycompany.com:3000` - while the image is only available locally, this should be omitted
6+
> * The namespace and/or repository, e.g. `jetbrains/teamcity-server`
7+
> * The `$tag` identifying the version, e.g. `latest`
8+
>
9+
> For images hosted on Docker Hub, the image reference is `docker.io/$namespace/$repository:$tag`, e.g. `docker.io/jetbrains/teamcity-server:latest`.
10+
>
11+
> If you are using your own registry, specify the value you would use for Docker CLI commands, e.g. `registry.mycompany.com/myrepo/myimage:latest`.

‎docs/_includes/render-table.html‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -25,17 +25,22 @@
2525
{%- endunless -%}
2626
{%- endif -%}
2727
{%- if displayRow == true -%}
28-
<tr>
29-
{%- for cell in include.table.headers -%}
30-
{%- assign columnId = cell[0] -%}
31-
{%- unless columnId == "_attributes" or table-omit-columns contains columnId -%}
32-
<td markdown="1" {% for attribute in row._attributes[columnId] %} {{ attribute[0] }}="{{ attribute[1] }}" {% endfor %} >
33-
28+
{%- if row._header -%}
29+
<tr>
30+
<th colspan='100' class='section-header'>{{ row._header }}</th>
31+
</tr>
32+
{%- else -%}
33+
<tr>
34+
{%- for cell in include.table.headers -%}
35+
{%- assign columnId = cell[0] -%}
36+
{%- unless columnId == "_attributes" or table-omit-columns contains columnId -%}
37+
<td markdown="1" {% for attribute in row._attributes[columnId] %} {{ attribute[0] }}="{{ attribute[1] }}" {% endfor %} >
3438
{{ row[columnId] }}
3539
</td>
36-
{%- endunless -%}
37-
{%- endfor -%}
38-
</tr>
40+
{%- endunless -%}
41+
{%- endfor -%}
42+
</tr>
43+
{%- endif -%}
3944
{%- endif -%}
4045
{%- endfor -%}
4146
</tbody>

‎docs/_sass/resources.scss‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -278,6 +278,12 @@ main > section.resources-section {
278278
background-color: #F6F6F6;
279279
}
280280

281+
thead th {
282+
position: sticky;
283+
top: 80px;
284+
background-color: #F6F6F6;
285+
}
286+
281287
td, th {
282288
border-top: 1px solid $grey-border-color;
283289
border-bottom: 1px solid $grey-border-color;

‎docs/artifact-configuration/reference.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,8 @@ Since the file's format does not change, the unsigned files are not needed anymo
5050
* [`<rpm-sign>`: RPM Package Manager](#rpm-sign)
5151
* [`<debsigs-sign>`: Debian packages](#debsigs-sign)
5252
* [`<xml-sign>`: XML Digital Signature](#xml-sign)
53+
* [`<notation-sign>`](#notation-sign),
54+
* [`<cosign-sign>`](#cosign-sign)
5355

5456
The general syntax for embedded signing methods is: `<`_format_`-sign />`
5557

@@ -324,6 +326,58 @@ See also:
324326

325327
* Use [metadata restrictions](#metadata-restrictions) for `<xml-file>` to restrict root element and namespace.
326328

329+
#### `<notation-sign>`: Notary (Notation) container signature {#notation-sign}
330+
331+
Sign container images using [Notation (Notary)](/signing-containers#notary).
332+
333+
{%- include_relative render-ac-directive-table.inc directive="notation-sign" -%}
334+
335+
This will place the signature at the right place within the OCI layout and add relevant references.
336+
337+
**Supported options:**
338+
339+
| Option | Optional | Description
340+
|------------------------|----------|----------------
341+
| `tag` | No | The image tag, e.g. `latest` or `v3.1.2`. Consider using [user-defined parameters](/artifact-configuration/syntax#parameters).
342+
343+
##### Example
344+
345+
~~~ xml
346+
<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
347+
<oci-image-layout-archive-file>
348+
<notation-sign tag="latest" />
349+
</oci-image-layout-archive-file>
350+
</artifact-configuration>
351+
~~~
352+
353+
_Note: You can create both Notary and [Cosign](#cosign-sign) signatures for the same image._
354+
355+
#### `<cosign-sign>`: Sigstore Cosign container signature {#cosign-sign}
356+
357+
Sign container images using [Sigstore Cosign](/signing-containers#cosign).
358+
359+
{%- include_relative render-ac-directive-table.inc directive="cosign-sign" -%}
360+
361+
This will place the signature at the right place within the OCI layout and add relevant references.
362+
363+
**Supported options:**
364+
365+
| Option | Optional | Description
366+
|------------------------|----------|----------------
367+
| `tag` | No | The image tag, e.g. `latest` or `v3.1.2`. Consider using [user-defined parameters](/artifact-configuration/syntax#parameters).
368+
369+
##### Example
370+
371+
~~~ xml
372+
<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
373+
<oci-image-layout-archive-file>
374+
<cosign-sign tag="latest" />
375+
</oci-image-layout-archive-file>
376+
</artifact-configuration>
377+
~~~
378+
379+
_Note: You can create both [Notary](#notation-sign) and Cosign signatures for the same image._
380+
327381
### Enveloped signing methods {#enveloped-signing-methods}
328382

329383
These signing methods create new files that contain both the original file and the signature. Enveloped signatures are available for all file types using the `<file>` element. Since the signed file is _added_, this `<file>` element must be contained in a `<zip-file>` element.

0 commit comments

Comments
 (0)