New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Signed release #1142

Open

mloiseleur opened this issue Jul 26, 2024 · 0 comments

Labels

Contributor

mloiseleur commented Jul 26, 2024 •

edited

Loading

Proposal

It would be nice if the release of this chart would be signed, for improved traceability and security.

It's a native feature of Helm.

Nowadays with OCI, it's possible to sign with a keyless approach using cosign. There is a documented GH action : https://github.com/sigstore/cosign-installer and simple steps to add

It's integrated into Flux, see here.

Verify can be done with Github integration, see for instance how karpenter chart can be verified.

mloiseleur added the kind/proposal label

mloiseleur changed the title ~~Signed chart~~ Signed release

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment