[Gatekeeper Library] Verifying packages on Artifact Hub

[dkubicahitachi]

Verifying packages
Why are helm packages not signed?

As the helm documentation says:
"Reasons a chart may not verify
These are common reasons for failure.

• The .prov file is missing or corrupt. This indicates that something is misconfigured or that the original maintainer did not create a provenance file.
• The key used to sign the file is not in your keyring. This indicate that the entity who signed the chart is not someone you've already signaled that you trust.
• The verification of the .prov file failed. This indicates that something is wrong with either the chart or the provenance data.
• The file hashes in the provenance file do not match the hash of the archive file. This indicates that the archive has been tampered with.

If a verification fails, there is reason to distrust the package."

helm upgrade csi csi-secrets-store-provider-azure/csi-secrets-store-provider-azure --verify --debug
Error: failed to fetch provenance "https://Azure.github.io/secrets-store-csi-driver-provider-azure/charts/csi-secrets-store-provider-azure-1.0.1.tgz.prov"

Can you add signed packages to the repository?

Environment:

• Secrets Store CSI Driver version: 1.0.1
• Azure Key Vault provider version: 1.0.1
• Kubernetes version: v1.18.6
• Cluster type: AKS