New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Start signing Helm releases #244

Open

atheriel opened this issue Jul 12, 2022 · 0 comments

Labels

Collaborator

atheriel commented Jul 12, 2022

Helm supports signing and verifying chart releases with GPG, which is not as convenient as Cosign but might be better than nothing. To actually use GPG we will need:

A key. I have some indication from SRE that we can expose RStudio's existing GPG key via GitHub Actions.
To use chart-releaser's existing (but not widely advertised) GPG signing support.
To update the README templates with a section explaining how users can verify these signatures.

atheriel added the security label

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment