Harness Helm Charts Provenance

Harness Helm charts are now signed to ensure they are secure and trustworthy.

Starting with version 0.24.0, you can verify the integrity and origin of the charts using GPG keys with Helm's provenance feature.

How to Verify Signed Helm Charts

Step 1: Install GnuPG

First, ensure you have GnuPG installed to handle the GPG keys.

apk add --no-cache gnupg

Step 2: Import the GPG Public Key

Import the Harness public key used to sign the charts. This key will be used to verify the signature.

gpg --keyserver hkps://keys.openpgp.org --receive-keys '6117ED4CA5F4605DBF4353F41F6E943934E6D138'

Step 3: Convert Keyring to Legacy Format

Convert the GPG keyring to a legacy format to be recognized by Helm provenance verification.

gpg --export >~/.gnupg/pubring.gpg
gpg --export-secret-keys >~/.gnupg/secring.gpg

Step 4: Verify the Helm Chart

Helm charts can be verified by downloading the chart or pulling it from the Helm repository.

a. Verify Downloaded Chart

Download the Helm chart and its corresponding provenance file from the GitHub releases page (*.tgz and *.tgz.prov under Assets).

helm verify harness-0.24.0.tgz

b. Verify Using Helm Repository

1. Add the Harness Helm repository:

   helm repo add harness https://harness.github.io/helm-charts/

2. Update the Helm repository:

   helm repo update

3. Pull the chart and verify it with the specified chart version:

   helm pull --verify harness/harness --version=0.24.0

Step 5: Successful Verification

A successful verification will display output similar to the following:

Signed by: Harness Inc. (Main key for Helm chart signing) <[e-mail]>
Using Key With Fingerprint: 6117ED4CA5F4605DBF4353F41F6E943934E6D138
Chart Hash Verified: sha256:a1af3a0b8b54050070e15953c1c964a595720be2640c59fb2df947c259d18247

---

ADDITIONAL INFORMATION

For more details on Helm chart signing and verification, please refer to the official Helm documentation.