Lightning Talk: Helm and the Sigstore Ecosystem

on YouTube ↗12m

" summary

Helm charts can be signed with the built‑in GPG flow using helm package --sign, producing a provenance file that contains the chart.yaml output, the package SHA and the signature. A Sigstore Helm plugin uploads the public key, signature, provenance and hash to Rekor so installs can verify provenance, and OCI charts can be signed at the blob level with cosign. Sigstore also publishes Helm charts to scaffold a full signing/verification stack; adoption of chart signing remains low despite Helm’s ~13,000 contributors.

AI-written summary · about

" chapters (11)

1. 0:00Intro
2. 1:09Ecosystem for Managing Application Delivery
3. 1:31What is Helm?
4. 2:15Helm Primary Components
5. 4:07Signing Helm Charts
6. 5:17Helm and Sigstore
7. 5:39Helm Sigstore Plugin
8. 7:28Signing Helm OCI Artifacts
9. 8:11Signing Blobs
10. 9:22Sigstore Helm Charts
11. 10:15Looking Ahead

" related talks

• 38mHelm: The Charts and the CuriousAndrew Block, Karena Angell, Scott Rigby, Paul C Czarkowski · KubeCon + CloudNativeCon North America 2021
• 31mFast & Secure: Package, Sign, Verify, and DeployKoray Oksay, Batuhan Apaydin · ContainerDays Conference 2024
• 34mIntro: HelmMatt Fisher, Michelle Noorali · KubeCon + CloudNativeCon Europe 2019
• 40mSigstore: How We Started, Where We Are, Where We are HeadedDan Lorenc, Bob Callaway · KubeCon + CloudNativeCon North America 2021
• 35mHelm: Past, Present, FutureBridget Kromhout, Matt Farina, Matt Butcher · KubeCon + CloudNativeCon North America 2020 Virtual
• 42mHelm Project 2022: How You Can Benefit, Ho...Andrew Block, Scott Rigby, Matt Butcher, Martin Hickey · KubeCon + CloudNativeCon Europe 2022
• 05mLightning Talk: New Helm Chart Installation Experience with Visual and Repeatable...Steven Zou · KubeCon + CloudNativeCon China 2019
• 23mSecuring Kubernetes Manifests with Sigstore Cosign, What Are Your Options?Mathieu Benoit · SupplyChainSecurityCon @ OSS NA 2023