{"id":4163641,"name":"github.com/notaryproject/notation","ecosystem":"go","description":"","homepage":"https://github.com/notaryproject/notation","licenses":"Apache-2.0","normalized_licenses":["Apache-2.0"],"repository_url":"https://github.com/notaryproject/notation","keywords_array":[],"namespace":"github.com/notaryproject","versions_count":52,"first_release_published_at":"2021-10-20T17:08:10.000Z","latest_release_published_at":"2025-04-24T03:08:51.000Z","latest_release_number":"v1.3.2","last_synced_at":"2026-10-14T09:22:03.563Z","created_at":"2022-04-12T18:00:38.199Z","updated_at":"2026-10-14T09:22:03.564Z","registry_url":"https://pkg.go.dev/github.com/notaryproject/notation","install_command":"go get github.com/notaryproject/notation","documentation_url":"https://pkg.go.dev/github.com/notaryproject/notation#section-documentation","metadata":null,"repo_metadata":{"id":37389356,"uuid":"257347648","full_name":"notaryproject/notation","owner":"notaryproject","description":"A CLI tool to sign and verify artifacts","archived":false,"fork":false,"pushed_at":"2026-09-25T01:43:02.000Z","size":13344,"stargazers_count":500,"open_issues_count":77,"forks_count":104,"subscribers_count":13,"default_branch":"main","last_synced_at":"2026-10-13T17:38:41.542Z","etag":null,"topics":["cloud-native","cncf","container","kubernetes","sign","verify"],"latest_commit_sha":null,"homepage":"https://notaryproject.dev","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/notaryproject.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":"MAINTAINERS","copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2020-04-20T16:56:00.000Z","updated_at":"2026-10-11T15:04:20.000Z","dependencies_parsed_at":"2022-07-14T06:10:31.145Z","dependency_job_id":"11fce1df-c89e-4232-9fdf-fb26ea4f280f","html_url":"https://github.com/notaryproject/notation","commit_stats":{"total_commits":441,"total_committers":47,"mean_commits":9.382978723404255,"dds":0.6235827664399093,"last_synced_commit":"b2d5facf72ae0cdfa32922df4ede8d48c725f48e"},"previous_names":["notaryproject/nv2"],"tags_count":48,"template":false,"template_full_name":null,"purl":"pkg:github/notaryproject/notation","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/notaryproject","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/sbom","scorecard":{"id":548281,"data":{"date":"2025-08-16T02:12:58Z","repo":{"name":"github.com/notaryproject/notation","commit":"0e3fc0a6e8c5c15312087887c16b3ddfbcd054ee"},"scorecard":{"version":"v5.2.1","commit":"ab2f6e92482462fe66246d9e32f642855a691dc1"},"score":8.2,"checks":[{"name":"Dependency-Update-Tool","score":10,"reason":"update tool detected","details":["Info: detected update tool: Dependabot: .github/dependabot.yml:1"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#dependency-update-tool"}},{"name":"Maintained","score":8,"reason":"7 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 8","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#maintained"}},{"name":"Pinned-Dependencies","score":10,"reason":"all dependencies are pinned","details":["Info:  14 out of  14 GitHub-owned GitHubAction dependencies pinned","Info:   4 out of   4 third-party GitHubAction dependencies pinned","Info:   1 out of   1 goCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#pinned-dependencies"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#binary-artifacts"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#dangerous-workflow"}},{"name":"Token-Permissions","score":10,"reason":"GitHub workflow tokens follow principle of least privilege","details":["Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:36","Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:37","Info: jobLevel 'actions' permission set to 'read': .github/workflows/scorecard.yml:39","Info: jobLevel 'contents' permission set to 'read': .github/workflows/scorecard.yml:40","Info: topLevel 'contents' permission set to 'read': .github/workflows/add-to-project.yml:20","Info: topLevel 'contents' permission set to 'read': .github/workflows/build.yml:21","Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:29","Info: topLevel 'contents' permission set to 'read': .github/workflows/license-checker.yml:27","Info: topLevel 'contents' permission set to 'read': .github/workflows/release-github.yml:22","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:30","Info: topLevel 'contents' permission set to 'read': .github/workflows/stale.yml:20","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#token-permissions"}},{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#code-review"}},{"name":"CII-Best-Practices","score":2,"reason":"badge detected: InProgress","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#cii-best-practices"}},{"name":"Vulnerabilities","score":8,"reason":"2 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GO-2025-3381 / GHSA-45v3-38pc-874v","Warn: Project is vulnerable to: GO-2025-3553 / GHSA-mh63-6h87-95cp"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":10,"reason":"SAST tool is run on all commits","details":["Info: SAST configuration detected: CodeQL","Info: all commits (30) are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#sast"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#fuzzing"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v1.3.2 not signed: https://api.github.com/repos/notaryproject/notation/releases/214999149","Warn: release artifact v2.0.0-alpha.1 not signed: https://api.github.com/repos/notaryproject/notation/releases/205452785","Warn: release artifact v1.3.1 not signed: https://api.github.com/repos/notaryproject/notation/releases/201939370","Warn: release artifact v1.3.0 not signed: https://api.github.com/repos/notaryproject/notation/releases/195774042","Warn: release artifact v1.3.0-rc.2 not signed: https://api.github.com/repos/notaryproject/notation/releases/192739841","Warn: release artifact v1.3.2 does not have provenance: https://api.github.com/repos/notaryproject/notation/releases/214999149","Warn: release artifact v2.0.0-alpha.1 does not have provenance: https://api.github.com/repos/notaryproject/notation/releases/205452785","Warn: release artifact v1.3.1 does not have provenance: https://api.github.com/repos/notaryproject/notation/releases/201939370","Warn: release artifact v1.3.0 does not have provenance: https://api.github.com/repos/notaryproject/notation/releases/195774042","Warn: release artifact v1.3.0-rc.2 does not have provenance: https://api.github.com/repos/notaryproject/notation/releases/192739841"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":8,"reason":"branch protection is not maximal on development and all release branches","details":["Info: 'allow deletion' disabled on branch 'main'","Info: 'force pushes' disabled on branch 'main'","Warn: 'branch protection settings apply to administrators' is disabled on branch 'main'","Warn: required approving review count is 1 on branch 'main'","Info: codeowner review is required on branch 'main'","Info: status check found to merge onto on branch 'main'","Info: PRs are required in order to make changes on branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#branch-protection"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: github.com/notaryproject/.github/SECURITY.md:1","Info: Found linked content: github.com/notaryproject/.github/SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/notaryproject/.github/SECURITY.md:1","Info: Found text in security policy: github.com/notaryproject/.github/SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#security-policy"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#license"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/release-github.yml:25"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#packaging"}},{"name":"CI-Tests","score":10,"reason":"30 out of 30 merged PRs checked by a CI test -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#ci-tests"}},{"name":"Contributors","score":10,"reason":"project has 13 contributing companies or organizations","details":["Info: found contributions from: Azure, MicrosoftDocs, OpenFunction, aws, datatrails, fluent, karmada-io, microsoft, microsoft @azure, notaryproject, opensource-f2f, oras-project, servicemesher"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/ab2f6e92482462fe66246d9e32f642855a691dc1/docs/checks.md#contributors"}}]},"last_synced_at":"2025-08-20T10:06:01.233Z","repository_id":37389356,"created_at":"2025-08-20T10:06:01.233Z","updated_at":"2025-08-20T10:06:01.233Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":343843146,"owners_count":38284192,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-13T02:00:04.984Z","response_time":52,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"notaryproject","name":"Notary Project","uuid":"32203186","kind":"organization","description":"","email":null,"website":null,"location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/32203186?v=4","repositories_count":19,"last_synced_at":"2026-10-06T12:45:31.276Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/notaryproject","funding_links":[],"total_stars":4443,"followers":98,"following":0,"created_at":"2022-11-13T04:55:38.826Z","updated_at":"2026-10-06T12:45:31.290Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/notaryproject","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/notaryproject/repositories"},"tags":[{"name":"v1.3.2","sha":"001cc919603c1dc16c6aad387c94b4209cb9c901","kind":"commit","published_at":"2025-04-24T03:08:51.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.3.2","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.3.2/manifests"},{"name":"v2.0.0-alpha.1","sha":"6c5c35a0207eebf8d4d6d2efad66b798457a6622","kind":"commit","published_at":"2025-03-12T08:48:36.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v2.0.0-alpha.1","html_url":"https://github.com/notaryproject/notation/releases/tag/v2.0.0-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v2.0.0-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v2.0.0-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v2.0.0-alpha.1/manifests"},{"name":"v1.3.1","sha":"bb571ddfb04f9d175daf64520fd18e7bea8ecbdf","kind":"commit","published_at":"2025-02-21T07:11:02.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.3.1","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.3.1/manifests"},{"name":"v1.3.0","sha":"8e5b5d59f5f5b45db20277614d5cfd73d4845c3a","kind":"commit","published_at":"2025-01-16T07:55:10.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.3.0","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.3.0/manifests"},{"name":"v1.3.0-rc.2","sha":"260968a379b1a3759d8881636595a997780b6e29","kind":"commit","published_at":"2024-12-30T02:15:17.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.3.0-rc.2","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.3.0-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.3.0-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.3.0-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.3.0-rc.2/manifests"},{"name":"v1.1.2","sha":"d055873720b1a21aa627ee56edc548e0d104002a","kind":"tag","published_at":"2024-10-15T01:45:47.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.1.2","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.1.2/manifests"},{"name":"v1.3.0-rc.1","sha":"0d9ceacde56c4b61dbbd7d83a7875986195781f8","kind":"commit","published_at":"2024-10-08T03:03:52.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.3.0-rc.1","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.3.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.3.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.3.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.3.0-rc.1/manifests"},{"name":"v1.2.0","sha":"4700ad6f1bef13e411772d7ae4399f891fc3a6ae","kind":"commit","published_at":"2024-08-29T02:13:05.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.2.0","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.2.0/manifests"},{"name":"v1.2.0-rc.1","sha":"b806f58f501628064b117c8b4299547dc67a742e","kind":"commit","published_at":"2024-08-20T00:18:29.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.2.0-rc.1","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.2.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.2.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.2.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.2.0-rc.1/manifests"},{"name":"v1.2.0-beta.1","sha":"787665fca2c748e412b86996fe8e86a1967ff542","kind":"commit","published_at":"2024-07-23T02:16:26.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.2.0-beta.1","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.2.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.2.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.2.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.2.0-beta.1/manifests"},{"name":"v1.2.0-alpha.1","sha":"2f4387276b4a73fb4b81f9499afe0aa156b56218","kind":"tag","published_at":"2024-06-12T08:56:38.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.2.0-alpha.1","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.2.0-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.2.0-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.2.0-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.2.0-alpha.1/manifests"},{"name":"v1.1.1","sha":"3dafd534fe069f2c0ce6127eb33d2e3e476723c3","kind":"tag","published_at":"2024-06-12T08:54:39.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.1.1","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.1.1/manifests"},{"name":"v1.1.0","sha":"99ca669edf9e171a912278166323b4c82f3d9706","kind":"tag","published_at":"2024-01-25T04:40:22.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.1.0","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.1.0/manifests"},{"name":"v1.0.1","sha":"e2f4237fb6ac602f68a786afaaf6388fb30b866d","kind":"tag","published_at":"2023-11-07T06:14:50.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.0.1","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.1/manifests"},{"name":"v1.0.0","sha":"80e3fc4e2eeb43ac00bc888cf41101f5c56f1535","kind":"tag","published_at":"2023-08-15T01:03:55.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.0.0","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0/manifests"},{"name":"v1.0.0-rc.7","sha":"ebfb9ef707996e1dc11898db8b90faa8e8816ae6","kind":"tag","published_at":"2023-05-26T18:07:52.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.0.0-rc.7","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.0.0-rc.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0-rc.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0-rc.7/manifests"},{"name":"v1.0.0-rc.6","sha":"cc3f7aa06b600a689af5274daa7c06fb3e55e69e","kind":"tag","published_at":"2023-05-26T03:25:58.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.0.0-rc.6","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.0.0-rc.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0-rc.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0-rc.6/manifests"},{"name":"v1.0.0-rc.5","sha":"d850c3f4ef79193ef88f9c6af75cdd8935d1ef18","kind":"tag","published_at":"2023-05-17T16:55:17.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.0.0-rc.5","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.0.0-rc.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0-rc.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0-rc.5/manifests"},{"name":"v1.0.0-rc.4","sha":"2e56dd42e385ee1568c5e13e6ef38edb2a549500","kind":"tag","published_at":"2023-04-24T06:48:13.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.0.0-rc.4","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.0.0-rc.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0-rc.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0-rc.4/manifests"},{"name":"v1.0.0-rc.3","sha":"233c0ea71edfb68b951eb54a739a101e2a05cd26","kind":"tag","published_at":"2023-03-07T13:58:40.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.0.0-rc.3","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.0.0-rc.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0-rc.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0-rc.3/manifests"},{"name":"v1.0.0-rc.2.dev.20230226","sha":"e47cf1253dcf6af1c7c9eb0688180a523a324d98","kind":"tag","published_at":"2023-02-26T16:03:20.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.0.0-rc.2.dev.20230226","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.2.dev.20230226","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.0.0-rc.2.dev.20230226","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0-rc.2.dev.20230226","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0-rc.2.dev.20230226/manifests"},{"name":"v1.0.0-rc.2","sha":"5e2fa4a36b1d6526381207e2223e4776c5db074e","kind":"tag","published_at":"2023-02-17T00:53:18.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.0.0-rc.2","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.0.0-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0-rc.2/manifests"},{"name":"v1.0.0-rc.1.dev.20230201","sha":"136ed182282d1be4f44637ed77124fbfb910865c","kind":"tag","published_at":"2023-02-01T17:58:28.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.0.0-rc.1.dev.20230201","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.1.dev.20230201","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.0.0-rc.1.dev.20230201","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0-rc.1.dev.20230201","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0-rc.1.dev.20230201/manifests"},{"name":"v1.0.0-rc.1","sha":"5b52dc6a2d752cdffc3f9c41125dd4a94f2ea002","kind":"tag","published_at":"2022-12-07T05:44:01.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v1.0.0-rc.1","html_url":"https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v1.0.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v1.0.0-rc.1/manifests"},{"name":"v0.12.0-beta.1.dev.20221204","sha":"55e8b5b3554299d379f98d77931f3a385de67bf7","kind":"tag","published_at":"2022-12-04T16:00:36.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.12.0-beta.1.dev.20221204","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.12.0-beta.1.dev.20221204","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.12.0-beta.1.dev.20221204","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.12.0-beta.1.dev.20221204","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.12.0-beta.1.dev.20221204/manifests"},{"name":"v0.12.0-beta.1.dev.20221120","sha":"53052a9de2b36ae743a2978810617ed73e83943f","kind":"tag","published_at":"2022-11-20T16:00:42.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.12.0-beta.1.dev.20221120","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.12.0-beta.1.dev.20221120","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.12.0-beta.1.dev.20221120","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.12.0-beta.1.dev.20221120","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.12.0-beta.1.dev.20221120/manifests"},{"name":"v0.12.0-beta.1.dev.20221113","sha":"53052a9de2b36ae743a2978810617ed73e83943f","kind":"tag","published_at":"2022-11-13T16:00:39.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.12.0-beta.1.dev.20221113","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.12.0-beta.1.dev.20221113","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.12.0-beta.1.dev.20221113","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.12.0-beta.1.dev.20221113","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.12.0-beta.1.dev.20221113/manifests"},{"name":"v0.12.0-beta.1.dev.20221106","sha":"ed5beb8ae7a1982005334693fc1fd19086c50160","kind":"tag","published_at":"2022-11-06T16:07:40.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.12.0-beta.1.dev.20221106","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.12.0-beta.1.dev.20221106","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.12.0-beta.1.dev.20221106","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.12.0-beta.1.dev.20221106","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.12.0-beta.1.dev.20221106/manifests"},{"name":"v0.12.0-beta.1","sha":"965a0b785467107ba9a2d37ee182c3c123b3eabf","kind":"tag","published_at":"2022-11-02T05:57:47.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.12.0-beta.1","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.12.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.12.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.12.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.12.0-beta.1/manifests"},{"name":"v0.11.0-alpha.4.dev.20221030","sha":"4d8da7412943eea01184de55a5e155d83502165f","kind":"tag","published_at":"2022-10-30T16:07:35.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.11.0-alpha.4.dev.20221030","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.11.0-alpha.4.dev.20221030","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.11.0-alpha.4.dev.20221030","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.11.0-alpha.4.dev.20221030","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.11.0-alpha.4.dev.20221030/manifests"},{"name":"v0.11.0-alpha.4.dev.20221023","sha":"4803a8b33c9ed2c2bfd51a88153c92568e1063be","kind":"tag","published_at":"2022-10-23T16:10:06.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.11.0-alpha.4.dev.20221023","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.11.0-alpha.4.dev.20221023","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.11.0-alpha.4.dev.20221023","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.11.0-alpha.4.dev.20221023","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.11.0-alpha.4.dev.20221023/manifests"},{"name":"v0.11.0-alpha.4.dev.20221016","sha":"080c6bb6049f71871f2e16dc7ae70aafc4f001b3","kind":"tag","published_at":"2022-10-16T16:09:41.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.11.0-alpha.4.dev.20221016","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.11.0-alpha.4.dev.20221016","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.11.0-alpha.4.dev.20221016","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.11.0-alpha.4.dev.20221016","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.11.0-alpha.4.dev.20221016/manifests"},{"name":"v0.11.0-alpha.4","sha":"b9f1fb5b30f2fc77b39a06b5899d399e8ecde165","kind":"commit","published_at":"2022-10-14T03:25:59.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.11.0-alpha.4","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.11.0-alpha.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.11.0-alpha.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.11.0-alpha.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.11.0-alpha.4/manifests"},{"name":"v0.10.0-alpha.3.dev.20221009","sha":"230d42754f2143752ecfbf2258c78d98811afdd6","kind":"tag","published_at":"2022-10-09T16:09:25.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.10.0-alpha.3.dev.20221009","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.10.0-alpha.3.dev.20221009","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.10.0-alpha.3.dev.20221009","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3.dev.20221009","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3.dev.20221009/manifests"},{"name":"v0.10.0-alpha.3.dev.20221002","sha":"e7e930c1a2571cc194ab30a4dfb118b9697ed09b","kind":"tag","published_at":"2022-10-02T16:08:38.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.10.0-alpha.3.dev.20221002","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.10.0-alpha.3.dev.20221002","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.10.0-alpha.3.dev.20221002","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3.dev.20221002","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3.dev.20221002/manifests"},{"name":"v0.10.0-alpha.3.dev.20220928","sha":"e7e930c1a2571cc194ab30a4dfb118b9697ed09b","kind":"tag","published_at":"2022-09-28T20:29:10.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.10.0-alpha.3.dev.20220928","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.10.0-alpha.3.dev.20220928","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.10.0-alpha.3.dev.20220928","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3.dev.20220928","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3.dev.20220928/manifests"},{"name":"v0.10.0-alpha.3.dev.20220925","sha":"06b7b5ba63a1863b117b1ad4c9162cba03d09e71","kind":"tag","published_at":"2022-09-25T16:07:28.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.10.0-alpha.3.dev.20220925","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.10.0-alpha.3.dev.20220925","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.10.0-alpha.3.dev.20220925","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3.dev.20220925","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3.dev.20220925/manifests"},{"name":"v0.10.0-alpha.3.dev.20220918","sha":"84db123f020c63719a110d9937f4e149a517f831","kind":"tag","published_at":"2022-09-18T16:07:38.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.10.0-alpha.3.dev.20220918","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.10.0-alpha.3.dev.20220918","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.10.0-alpha.3.dev.20220918","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3.dev.20220918","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3.dev.20220918/manifests"},{"name":"v0.10.0-alpha.3.dev.20220911","sha":"8bec8a7742da579d8bc61d2eb33484b2c61dd231","kind":"tag","published_at":"2022-09-11T16:07:33.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.10.0-alpha.3.dev.20220911","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.10.0-alpha.3.dev.20220911","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.10.0-alpha.3.dev.20220911","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3.dev.20220911","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3.dev.20220911/manifests"},{"name":"v0.10.0-alpha.3.dev.20220904","sha":"8bec8a7742da579d8bc61d2eb33484b2c61dd231","kind":"tag","published_at":"2022-09-04T16:07:26.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.10.0-alpha.3.dev.20220904","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.10.0-alpha.3.dev.20220904","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.10.0-alpha.3.dev.20220904","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3.dev.20220904","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3.dev.20220904/manifests"},{"name":"v0.10.0-alpha.3.dev.20220828","sha":"c56a4ba1e473f4a48d4c4701181eadb1fb5acdec","kind":"tag","published_at":"2022-08-28T16:06:45.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.10.0-alpha.3.dev.20220828","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.10.0-alpha.3.dev.20220828","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.10.0-alpha.3.dev.20220828","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3.dev.20220828","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3.dev.20220828/manifests"},{"name":"v0.10.0-alpha.3.dev.20220821","sha":"4bf25dfacf0239823311e470b702ceb0435a0299","kind":"tag","published_at":"2022-08-21T16:07:23.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.10.0-alpha.3.dev.20220821","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.10.0-alpha.3.dev.20220821","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.10.0-alpha.3.dev.20220821","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3.dev.20220821","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3.dev.20220821/manifests"},{"name":"v0.10.0-alpha.3","sha":"e73bfc38b738a49055e260998e67308974fbcbfc","kind":"commit","published_at":"2022-08-18T09:05:09.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.10.0-alpha.3","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.10.0-alpha.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.10.0-alpha.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.10.0-alpha.3/manifests"},{"name":"v0.9.0-alpha.1","sha":"7ff93cd4d915f05966df238c1b28155cac651d51","kind":"commit","published_at":"2022-06-01T04:15:45.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.9.0-alpha.1","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.9.0-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.9.0-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.9.0-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.9.0-alpha.1/manifests"},{"name":"feat-kv-extensibility","sha":"17c76071f83206b139cda3413b1bf562d01adc0c","kind":"commit","published_at":"2022-01-20T22:33:00.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/feat-kv-extensibility","html_url":"https://github.com/notaryproject/notation/releases/tag/feat-kv-extensibility","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@feat-kv-extensibility","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/feat-kv-extensibility","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/feat-kv-extensibility/manifests"},{"name":"v0.7.1-alpha.1-feat-kv-extensibility","sha":"8360c704fa0be4fea85b5aefe7a13d298244b6e2","kind":"commit","published_at":"2021-12-17T22:14:48.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.7.1-alpha.1-feat-kv-extensibility","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.7.1-alpha.1-feat-kv-extensibility","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.7.1-alpha.1-feat-kv-extensibility","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.7.1-alpha.1-feat-kv-extensibility","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.7.1-alpha.1-feat-kv-extensibility/manifests"},{"name":"v0.7.1-alpha.1","sha":"1608db29a21b2da5605285c028096206458be271","kind":"commit","published_at":"2021-11-19T14:23:50.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.7.1-alpha.1","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.7.1-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.7.1-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.7.1-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.7.1-alpha.1/manifests"},{"name":"v0.7.0-alpha.1","sha":"2f51db34942fbc17a1992d88c0b282e9e3e85a1b","kind":"tag","published_at":"2021-10-20T17:20:49.000Z","download_url":"https://codeload.github.com/notaryproject/notation/tar.gz/v0.7.0-alpha.1","html_url":"https://github.com/notaryproject/notation/releases/tag/v0.7.0-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/notaryproject/notation@v0.7.0-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.7.0-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/tags/v0.7.0-alpha.1/manifests"}]},"repo_metadata_updated_at":"2026-10-13T18:41:30.554Z","dependent_packages_count":7,"downloads":null,"downloads_period":null,"dependent_repos_count":5,"rankings":{"downloads":null,"dependent_repos_count":2.3081120463492657,"dependent_packages_count":1.8259580139610927,"stargazers_count":3.9488949609149007,"forks_count":2.994430400559015,"docker_downloads_count":null,"average":2.7693488554460686},"purl":"pkg:golang/github.com/notaryproject/notation","advisories":[{"uuid":"GSA_kwCzR0hTQS01N3d4LW02MzYtZzNnOM4AA4lw","url":"https://github.com/advisories/GHSA-57wx-m636-g3g8","title":"Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry","description":"### Impact\nAn external actor with control of a compromised container registry can provide outdated versions of OCI artifacts, such as Images. This could lead artifact consumers with relaxed trust policies (such as `permissive` instead of `strict`) to potentially use artifacts with signatures that are no longer valid, making them susceptible to any exploits those artifacts may contain.\n\n### Mitigation\nIn Notary Project, an artifact publisher can control the validity period of artifact by specifying signature expiry during the signing process. Using shorter signature validity periods along with processes to periodically resign artifacts, allows artifact producers to ensure that their consumers will only receive up-to-date artifacts. Artifact consumers should correspondingly use a `strict` or equivalent trust policy that enforces signature expiry. Together these steps enable use of up-to-date artifacts and safeguard against rollback attack in the event of registry compromise. The Notary Project offers various signature validation options such as `permissive`, `audit` and `skip` to support various scenarios. These scenarios includes 1) situations demanding urgent workload deployment, necessitating the bypassing of expired or revoked signatures; 2) auditing of artifacts lacking signatures without interrupting workload; and 3) skipping of verification for specific images that might have undergone validation through alternative mechanisms.\n\nAdditionally, the Notary Project supports revocation to ensure the signature freshness. Artifact publishers can sign with short-lived certificates and revoke older certificates when necessary. This revocation serves as a signal to inform artifact consumers that the corresponding unexpired artifact is no longer approved by the publisher. This enables the artifact publisher to control the validity of the signature independently of their ability to manage artifacts in a compromised registry.\n\n### Credit\nThe Notary Project extends its gratitude to Justin Cappos (@JustinCappos) for responsibly disclosing the issue.\n\n_**Note:** we have updated [threat model](https://github.com/notaryproject/specifications/blob/main/threatmodels/notation-threatmodel.md) to include considerations for rollback attack.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-01-19T22:12:22.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.0,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:L","references":["https://github.com/notaryproject/specifications/security/advisories/GHSA-57wx-m636-g3g8","https://nvd.nist.gov/vuln/detail/CVE-2024-23332","https://github.com/notaryproject/specifications/commit/cdabdd1042de2999c685fa5d422a785ded9c983a","https://github.com/advisories/GHSA-57wx-m636-g3g8"],"source_kind":"github","identifiers":["GHSA-57wx-m636-g3g8","CVE-2024-23332"],"repository_url":"https://github.com/notaryproject/specifications","blast_radius":0.0,"created_at":"2024-01-19T23:06:16.604Z","updated_at":"2026-10-03T14:10:19.171Z","epss_percentage":0.0029,"epss_percentile":0.19524,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01N3d4LW02MzYtZzNnOM4AA4lw","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS01N3d4LW02MzYtZzNnOM4AA4lw","packages":[{"ecosystem":"go","package_name":"github.com/notaryproject/notation","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.0.0"}],"purl":"pkg:go/github.com%2Fnotaryproject%2Fnotation"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01N3d4LW02MzYtZzNnOM4AA4lw/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1ydnJ4LXJyd2gtcjlwNs4AAzr3","url":"https://github.com/advisories/GHSA-rvrx-rrwh-r9p6","title":"Notation's default `maxSignatureAttempts` in `notation verify` enables an endless data attack","description":"### Impact\nAn attacker who controls or compromises a registry can make the registry serve an infinite number of signatures for the artifact, causing a denial of service to the host machine running `notation verify`.\n\n### Patches\nThe problem has been fixed in the release [v1.0.0-rc.6](https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6). Users should upgrade their notation packages to [v1.0.0-rc.6](https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6) or above.\n\n### Workarounds\nUser should use secure and trusted container registries\n\n### Credits\nThe `notation` project would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing the issue found during an security audit (facilitated by OSTIF and sponsored by CNCF) and Shiwei Zhang (@shizhMSFT) for root cause analysis.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2023-06-06T16:44:58.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","references":["https://github.com/notaryproject/notation/security/advisories/GHSA-rvrx-rrwh-r9p6","https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6","https://nvd.nist.gov/vuln/detail/CVE-2023-33958","https://github.com/advisories/GHSA-rvrx-rrwh-r9p6"],"source_kind":"github","identifiers":["GHSA-rvrx-rrwh-r9p6","CVE-2023-33958"],"repository_url":"https://github.com/notaryproject/notation","blast_radius":0.0,"created_at":"2023-06-06T17:03:22.791Z","updated_at":"2026-10-03T14:12:47.430Z","epss_percentage":0.00485,"epss_percentile":0.39558,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ydnJ4LXJyd2gtcjlwNs4AAzr3","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1ydnJ4LXJyd2gtcjlwNs4AAzr3","packages":[{"ecosystem":"go","package_name":"github.com/notaryproject/notation","versions":[{"first_patched_version":"1.0.0-rc.6","vulnerable_version_range":"\u003c 1.0.0-rc.6"}],"purl":"pkg:go/github.com%2Fnotaryproject%2Fnotation"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ydnJ4LXJyd2gtcjlwNs4AAzr3/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS05bTN2LXY0cjUtcHB4N84AAzr2","url":"https://github.com/advisories/GHSA-9m3v-v4r5-ppx7","title":"Notation vulnerable to denial of service from high number of artifact signatures","description":"### Impact\nAn attacker who controls or compromises a registry can make the registry serve an infinite number of signatures for the artifact, causing a denial of service to the host machine running `notation verify`.\n\n### Patches\nThe problem has been fixed in the release [v1.0.0-rc.6](https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6). Users should upgrade their notation packages to [v1.0.0-rc.6](https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6) or above.\n\n### Workarounds\nUser should use secure and trusted container registries.\n\n### Credits\nThe `notation` project would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing the issue found during an security audit (facilitated by OSTIF and sponsored by CNCF) and Shiwei Zhang (@shizhMSFT) for root cause analysis.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2023-06-06T16:43:01.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.7,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","references":["https://github.com/notaryproject/notation/security/advisories/GHSA-9m3v-v4r5-ppx7","https://github.com/notaryproject/notation/commit/ed22fde52f6d70ae0b53521bd28c9ccafa868c24","https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6","https://nvd.nist.gov/vuln/detail/CVE-2023-33957","https://github.com/advisories/GHSA-9m3v-v4r5-ppx7"],"source_kind":"github","identifiers":["GHSA-9m3v-v4r5-ppx7","CVE-2023-33957"],"repository_url":"https://github.com/notaryproject/notation","blast_radius":0.0,"created_at":"2023-06-06T17:03:22.804Z","updated_at":"2026-10-14T08:10:46.029Z","epss_percentage":0.00506,"epss_percentile":0.4152,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05bTN2LXY0cjUtcHB4N84AAzr2","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS05bTN2LXY0cjUtcHB4N84AAzr2","packages":[{"ecosystem":"go","package_name":"github.com/notaryproject/notation","versions":[{"first_patched_version":"1.0.0-rc.6","vulnerable_version_range":"\u003c 1.0.0-rc.6"}],"purl":"pkg:go/github.com%2Fnotaryproject%2Fnotation","statistics":{"dependent_packages_count":7,"dependent_repos_count":5,"downloads":null,"downloads_period":null},"affected_versions":["v0.7.0-alpha.1","v0.7.1-alpha.1","v0.7.1-alpha.1-feat-kv-extensibility","v0.9.0-alpha.1","v0.10.0-alpha.3.dev.20220904","v0.10.0-alpha.3.dev.20220918","v0.10.0-alpha.3.dev.20220925","v0.10.0-alpha.3.dev.20220928","v0.10.0-alpha.3.dev.20220821","v0.10.0-alpha.3","v0.10.0-alpha.3.dev.20220828","v0.10.0-alpha.3.dev.20220911","v0.10.0-alpha.3.dev.20221002","v0.10.0-alpha.3.dev.20221009","v0.11.0-alpha.4.dev.20221023","v0.11.0-alpha.4","v0.11.0-alpha.4.dev.20221016","v0.11.0-alpha.4.dev.20221030","v0.12.0-beta.1","v0.12.0-beta.1.dev.20221127","v0.12.0-beta.1.dev.20221113","v0.12.0-beta.1.dev.20221106","v0.12.0-beta.1.dev.20221120","v0.12.0-beta.1.dev.20221204","v1.0.0-rc.1","v1.0.0-rc.1.dev.20230201","v1.0.0-rc.1.dev.20230205","v1.0.0-rc.1.dev.20230210","v1.0.0-rc.1.dev.20230212","v1.0.0-rc.1.dev.20230216","v1.0.0-rc.2","v1.0.0-rc.2.dev.20230219","v1.0.0-rc.2.dev.20230226","v1.0.0-rc.3","v1.0.0-rc.4","v1.0.0-rc.5"],"unaffected_versions":["v1.0.0","v1.0.1","v1.1.0","v1.1.1","v1.1.2","v1.2.0","v1.3.0","v1.3.1","v1.3.2"]}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05bTN2LXY0cjUtcHB4N84AAzr2/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/notaryproject/notation","docker_dependents_count":1,"docker_downloads_count":32648,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/notaryproject/notation","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/notaryproject/notation/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-10-04T19:47:00.515Z","issues_count":215,"pull_requests_count":745,"avg_time_to_close_issue":20110429.128,"avg_time_to_close_pull_request":1303353.172143975,"issues_closed_count":125,"pull_requests_closed_count":639,"pull_request_authors_count":36,"issue_authors_count":60,"avg_comments_per_issue":3.265116279069767,"avg_comments_per_pull_request":1.7932885906040268,"merged_pull_requests_count":491,"bot_issues_count":3,"bot_pull_requests_count":415,"past_year_issues_count":10,"past_year_pull_requests_count":19,"past_year_avg_time_to_close_issue":8005484.5,"past_year_avg_time_to_close_pull_request":5792818.0,"past_year_issues_closed_count":4,"past_year_pull_requests_closed_count":3,"past_year_pull_request_authors_count":7,"past_year_issue_authors_count":9,"past_year_avg_comments_per_issue":2.6,"past_year_avg_comments_per_pull_request":2.736842105263158,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":10,"past_year_merged_pull_requests_count":1,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/notaryproject%2Fnotation/issues","maintainers":[{"login":"FeynmanZhou","count":43,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/FeynmanZhou"},{"login":"leandrohstein","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/leandrohstein"},{"login":"hanv14","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/hanv14"}],"active_maintainers":[]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fnotaryproject%2Fnotation/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fnotaryproject%2Fnotation/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fnotaryproject%2Fnotation/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fnotaryproject%2Fnotation/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fnotaryproject%2Fnotation/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fnotaryproject%2Fnotation/codemeta","maintainers":[]}