More infos about signing helm charts :
- Generate a
.prov file using helm sign command : https://helm.sh/docs/topics/provenance/
- Upload the
.prov file using helm sigstore upload <path_to_packaged_chart>
- Add following infos in
Chart.yaml
annotations:
artifacthub.io/signKey: |
fingerprint: <empreinte de votre clé>
url: <url publique de la clé ou du certificat>
For the GPG part we can use this action by crazy-max 😅 : https://github.com/marketplace/actions/import-gpg