Cosign vs Notation: perbandingan

Cosign vs Notation
Fakta	Cosign	Notation
Bahasa	Go	Go
Lisensi	Apache-2.0	Apache-2.0
Bintang	6.4k	502
Terbaru	v3.1.3	v1.3.2
Push terakhir	2026-10-16	2026-09-25
Frekuensi rilis	sekitar 10 hari antar rilis	sekitar 48 hari antar rilis
Kontributor aktif	23 penulis commit di branch default dalam 90 hari terakhir	1 penulis commit di branch default dalam 90 hari terakhir
Peringatan	tidak ada	tidak ada

Hubungan keduanya

Cosign menggantikan Notation. Alternatif Notation →
Pengganti penuhSigns and verifies container images and other artifacts, with keyless signing through Sigstore.
Notation menggantikan Cosign. Alternatif Cosign →
Pengganti penuhSigns and verifies OCI artifacts using X.509 certificates and a trust policy.

v3.1.32026-08-06This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle.
v2.6.52026-08-06This release backports GHSA-fx35-mq7g-6g98 (Verification bypass via public key in legacy bundle) to Cosign v2.6.x.
v3.1.22026-07-17This may be the last Cosign v3.1 release, as we finish deprecations and removing unused functionality. Soon we'll start…
v2.6.42026-07-17This release is a backport of OCI manifest fixes, and better support for cosign attestation download when you are using…
v3.1.12026-06-09_Note: v3.1.0 was skipped due to a bug in our release pipeline. v3.1.1 is identical to v3.1.0_

v1.3.22025-04-27Vote PASSED [+4 -0]:
v2.0.0-alpha.12025-03-13In notation v1.x, the notation sign command defaults to storing signatures using the OCI referrers tag schema for maxim…pra-rilis
v1.3.12025-02-24Vote PASSED [+5 -0]: #1186
v1.3.02025-01-21Notation v1.3.0 is an implementation of Notary Project Specifications v1.1.0.
v1.3.0-rc.22024-12-31Vote PASSED [+4 -0]: #1130pra-rilis

✓ bertanda tangan Rilis terbaru, v3.1.3, memiliki tanda tangan yang diverifikasi GitHub.

Memuat laporan keamanan

✓ bertanda tangan Rilis terbaru, v1.3.2, memiliki tanda tangan yang diverifikasi GitHub.

Memuat laporan keamanan