Signed helm charts

[devmaxxing]

Is your feature request related to a problem? Please describe.
We would like to verify the integrity of the helm charts we are installing but cannot do so because the loki helm charts are not signed.

Describe the solution you'd like
We would like for the loki helm charts to be signed and public key published as per https://helm.sh/docs/topics/provenance/

Describe alternatives you've considered
Not verifying the integrity of our helm charts (not ideal).

Additional context
We are in the process of trying to secure our deployments of third-party helm charts.

[stale]

This issue has been automatically marked as stale because it has not had any activity in the past 30 days. It will be closed in 7 days if no further activity occurs. Thank you for your contributions.

[cyriltovena]

Hold on got something!

[cyriltovena]

I already published latest charts with the .prov file if you want to give a go @oliverfei that would be great.

You can find the public key in the PR closing this issue.

[devmaxxing]

Thanks @cyriltovena.
I imported the public key and then tried running:
helm repo add loki https://grafana.github.io/loki/charts
helm fetch loki/loki --verify
and am getting the following error:

Error: sha256 sum does not match for loki-0.25.3.tgz: "sha256:5c6a6ae8536359adfa0e62964f1efed112013251773cf483c5ac26ea1bfb6ba6" != "sha256:006616496cc1084056d754d4cd897c600cf6ca55a0a363bbe40a6523a654eede"

Also tried verifying promtail, loki-stack, and fluent-bit and got similar sha256 errors.

[cyriltovena]

Ok I'll look into it.

[cyriltovena]

hm I'm getting a different prov file with a different sha256 of the file on every run, even locally. Either I've miss-configured it or there's some bug with helm sha256 encoding.

I'm doing this helm package --sign --key "Grafana Loki" --keyring sec.gpg production/helm/loki and on every run the prov file has a different sha256.

[cyriltovena]

I think the key was wrong in fact, resigning it even if the sha has changed is working with a new key.

[cyriltovena]

Can you try again ? I didn't change anything but re-uploaded it.

And I'm getting good result now

helm fetch loki/loki --verify --keyring public.pgp
Verification: &{0xc000609c20 sha256:5e404c301d34ddb708b82af861ee2c3c96e52bfea41ebf2e1144b44e070e2805 loki-0.25.3.tgz}

[devmaxxing]

Yeah. It verifies successfully now.

[cyriltovena]

¯\(ツ)/¯