Uptime monitoring for Codenotary

Codenotary (VCAS — VChain Authenticity Service) is an open-source software supply chain security platform that provides cryptographic notarization for container images, binaries, source code, and Software Bills of Materials (SBOMs). Teams use it to sign and verify artifacts throughout the CI/CD pipeline, ensuring that only trusted, authenticated software reaches production. When the Codenotary Cloud API or notarization service goes down, artifact verification pipelines stall and deployments block.

This tutorial covers production-grade uptime monitoring for Codenotary using Vigilmon. We will walk through:

• Monitoring the Codenotary Cloud API health endpoint
• Notarization service availability checks
• SBOM generation endpoint monitoring
• SSL certificate alerts for the Codenotary API domain
• Heartbeat monitoring for scheduled artifact verification pipelines

Prerequisites

• A Codenotary Cloud account or self-hosted VCAS instance
• The vcn CLI installed (for verification testing)
• A free account at vigilmon.online

Part 1: Verify the Codenotary Cloud API health endpoint

Codenotary Cloud exposes a health endpoint that returns the operational status of the API gateway and backend services. Confirm it is reachable before adding the monitor:

curl -s https://api.codenotary.io/health | jq .

Expected response:

{
  "status": "ok",
  "timestamp": "2026-07-12T10:00:00Z",
  "services": {
    "notarization": "ok",
    "verification": "ok",
    "sbom": "ok"
  }
}

For self-hosted VCAS deployments, the health endpoint is typically:

curl -s https://vcas.example.com/api/v1/health | jq .

Part 2: Monitor the Codenotary Cloud API health endpoint

1. Log in to vigilmon.online and click Add Monitor.
2. Choose HTTP(S) monitor.
3. Enter: https://api.codenotary.io/health (or your self-hosted URL).
4. Set interval to 1 minute.
5. Set expected status code to 200.
6. Add a keyword check: must contain "status":"ok".
7. Add your alert channel (email, Slack, webhook).
8. Click Save.

Vigilmon polls this endpoint from multiple geographic regions. If any region cannot reach the Codenotary API — meaning your verification pipelines would block — an incident is triggered immediately.

Part 3: Monitor notarization service availability

Notarization is the core operation of Codenotary: signing an artifact with a cryptographic identity that can be independently verified. A healthy health endpoint does not guarantee the notarization subsystem can accept requests — monitor it directly.

The vcn CLI's login and notarize operations depend on the notarization API. Expose a lightweight probe that tests actual notarization capability:

#!/usr/bin/env bash
# /usr/local/bin/codenotary-probe.sh

set -euo pipefail

VCAS_HOST="https://api.codenotary.io"
PROBE_ARTIFACT="/tmp/codenotary-probe-$(date +%Y%m%d).txt"
HEARTBEAT_URL="https://vigilmon.online/api/heartbeat/YOUR_TOKEN"

# Create a tiny probe artifact
echo "vigilmon-probe $(date -u +%Y-%m-%dT%H:%M:%SZ)" > "$PROBE_ARTIFACT"

# Attempt notarization (uses stored vcn credentials)
vcn notarize --silent --output json "$PROBE_ARTIFACT" > /tmp/vcn-notarize-result.json 2>&1

STATUS=$(jq -r '.status' /tmp/vcn-notarize-result.json 2>/dev/null || echo "error")

if [ "$STATUS" = "TRUSTED" ] || [ "$STATUS" = "0" ]; then
  echo "[$(date)] Notarization probe succeeded"
  curl -fsS --retry 3 "$HEARTBEAT_URL" > /dev/null
else
  echo "[$(date)] Notarization probe FAILED — status: $STATUS" >&2
  exit 1
fi

For self-hosted VCAS, point vcn at your instance:

export VCN_NOTARIZATION_API="https://vcas.example.com"
vcn notarize "$PROBE_ARTIFACT"

Schedule the probe every 5 minutes and add a Vigilmon heartbeat monitor (covered in Part 5).

Alternatively, add a direct HTTP monitor targeting the notarization API endpoint:

1. Click Add Monitor → HTTP(S) monitor.
2. Enter: https://api.codenotary.io/api/v1/notarize/status
3. Set interval to 2 minutes.
4. Set expected status code to 200 or 401 (authentication required, but the endpoint is reachable).
5. Add your alert channel.
6. Click Save.

A 401 response confirms the notarization endpoint is up and processing requests; only a 5xx error or connection timeout signals a real service failure.

Part 4: Monitor the SBOM generation endpoint

Codenotary's SBOM features let you generate and notarize Software Bills of Materials — tracking third-party dependencies and their trust status. SBOM generation is often the most resource-intensive operation and the first to degrade under load.

Check the SBOM endpoint:

curl -s -o /dev/null -w "%{http_code}" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  https://api.codenotary.io/api/v1/sbom

Add a monitor:

1. Click Add Monitor → HTTP(S) monitor.
2. Enter: https://api.codenotary.io/api/v1/sbom
3. Set interval to 5 minutes.
4. Under Headers, add: Authorization: Bearer YOUR_TOKEN
5. Set expected status code to 200 or 405 (method not allowed for GET — the endpoint is reachable).
6. Add your alert channel.
7. Click Save.

For self-hosted deployments, the SBOM endpoint path may differ — check your VCAS API documentation for the correct path under your version.

Part 5: Heartbeat monitoring for scheduled artifact verification pipelines

Codenotary is most valuable when artifact verification runs automatically in your CI/CD pipeline. A failed pipeline that exits cleanly (zero exit code but skipped verification) is the most dangerous failure mode. Vigilmon heartbeats catch it.

Add heartbeat verification to your CI pipeline

For a GitHub Actions pipeline:

# .github/workflows/verify-artifacts.yml
name: Verify Supply Chain Integrity

on:
  schedule:
    - cron: '0 */6 * * *'   # every 6 hours
  workflow_dispatch:

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - name: Install vcn
        run: |
          curl -L https://github.com/codenotary/vcn/releases/latest/download/vcn-linux-amd64 \
            -o /usr/local/bin/vcn
          chmod +x /usr/local/bin/vcn

      - name: Authenticate
        env:
          VCN_USER: ${{ secrets.VCN_USER }}
          VCN_PASSWORD: ${{ secrets.VCN_PASSWORD }}
        run: vcn login

      - name: Verify production artifacts
        run: |
          vcn verify docker://your-registry/your-image:latest
          vcn verify docker://your-registry/your-image:stable

      - name: Send Vigilmon heartbeat
        if: success()
        run: |
          curl -fsS --retry 3 \
            "https://vigilmon.online/api/heartbeat/${{ secrets.VIGILMON_HEARTBEAT_TOKEN }}"

For a GitLab CI pipeline:

# .gitlab-ci.yml
verify-supply-chain:
  stage: verify
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
  script:
    - curl -L https://github.com/codenotary/vcn/releases/latest/download/vcn-linux-amd64
        -o /usr/local/bin/vcn && chmod +x /usr/local/bin/vcn
    - VCN_USER="$VCN_USER" VCN_PASSWORD="$VCN_PASSWORD" vcn login
    - vcn verify docker://registry.example.com/app:latest
    - |
      curl -fsS --retry 3 \
        "https://vigilmon.online/api/heartbeat/$VIGILMON_HEARTBEAT_TOKEN"

Create the heartbeat monitor in Vigilmon

1. In Vigilmon, click Add Monitor → Heartbeat monitor.
2. Name it: Codenotary artifact verification pipeline.
3. Set expected interval to 6 hours (matching your cron schedule).
4. Set grace period to 30 minutes.
5. Copy the heartbeat URL and add it as a CI secret (VIGILMON_HEARTBEAT_TOKEN).
6. Click Save.

If the pipeline is cancelled, times out, or the vcn verify command fails before sending the heartbeat, Vigilmon alerts you — so a silent supply chain verification failure never goes unnoticed.

Part 6: SSL certificate monitoring

Codenotary's API endpoints rely on valid TLS certificates. An expired certificate on the API gateway blocks all vcn operations and HTTPS calls from your CI/CD pipelines — effectively halting your entire artifact verification workflow.

1. In Vigilmon, click Add Monitor → SSL monitor.
2. Enter: api.codenotary.io (or your self-hosted VCAS hostname).
3. Set alert threshold to 14 days before expiry.
4. Add your alert channel.
5. Click Save.

Check the certificate expiry manually:

openssl s_client -connect api.codenotary.io:443 </dev/null 2>/dev/null \
  | openssl x509 -noout -dates

For self-hosted VCAS deployments with Let's Encrypt, verify the auto-renewal cron job is configured correctly:

# Check certbot timer
systemctl status certbot.timer

# Test renewal dry-run
certbot renew --dry-run

Vigilmon's 14-day alert catches renewal failures weeks before the certificate actually expires — giving you time to intervene before pipelines break.

Part 7: Webhook alerts for supply chain events

Route Vigilmon downtime events to your security operations channel:

// Webhook receiver for Codenotary monitoring events
import express from 'express';

const app = express();
app.use(express.json());

app.post('/webhook/vigilmon', (req, res) => {
  const { monitor_name, status, url, checked_at, response_time_ms } = req.body;

  if (status === 'down') {
    console.error('[VIGILMON] CRITICAL: Codenotary monitor DOWN', {
      monitor: monitor_name,
      url,
      at: checked_at,
    });
    // Codenotary down = artifact verification blocked = deployments may be untrusted
    notifySecOps({
      service: 'Codenotary',
      monitor: monitor_name,
      message: 'Supply chain verification unavailable — review deployment gates',
    });
  } else if (status === 'up') {
    console.info('[VIGILMON] Codenotary monitor recovered', {
      monitor: monitor_name,
      responseMs: response_time_ms,
    });
  }

  res.sendStatus(204);
});

app.listen(3000);

Summary

Your Codenotary deployment now has five layers of external monitoring:

1. Cloud API health check — polls /health from multiple regions to catch API gateway and backend failures.
2. Notarization endpoint check — confirms the core notarization subsystem is accepting requests.
3. SBOM endpoint check — independently monitors the SBOM generation service.
4. Heartbeat monitor — your scheduled artifact verification pipeline pings Vigilmon; missing pings mean verification was skipped.
5. SSL certificate monitor — alerts you 14 days before the API certificate expires and blocks vcn operations.

Vigilmon handles check scheduling, multi-region polling, alert routing, and uptime history. You get notified within 60 seconds of any failure in your Codenotary supply chain verification stack.

Monitor your Codenotary infrastructure free at vigilmon.online

#codenotary #supplychain #devsecops #monitoring #devops #sbom