{"id":13819792,"url":"https://github.com/sigstore/helm-sigstore","last_synced_at":"2025-08-10T22:44:54.957Z","repository":{"id":38191406,"uuid":"367127300","full_name":"sigstore/helm-sigstore","owner":"sigstore","description":"Plugin for Helm to integrate the sigstore ecosystem","archived":false,"fork":false,"pushed_at":"2025-07-18T13:57:00.000Z","size":619,"stargazers_count":64,"open_issues_count":2,"forks_count":14,"subscribers_count":6,"default_branch":"main","last_synced_at":"2025-07-18T18:22:05.537Z","etag":null,"topics":["helm","sigstore"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sigstore.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2021-05-13T17:39:42.000Z","updated_at":"2025-07-18T13:57:02.000Z","dependencies_parsed_at":"2023-12-22T14:54:00.727Z","dependency_job_id":"7e422700-4d4f-4e5f-951f-6f1be555d386","html_url":"https://github.com/sigstore/helm-sigstore","commit_stats":null,"previous_names":[],"tags_count":8,"template":false,"template_full_name":null,"purl":"pkg:github/sigstore/helm-sigstore","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sigstore%2Fhelm-sigstore","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sigstore%2Fhelm-sigstore/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sigstore%2Fhelm-sigstore/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sigstore%2Fhelm-sigstore/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sigstore","download_url":"https://codeload.github.com/sigstore/helm-sigstore/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sigstore%2Fhelm-sigstore/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":269799505,"owners_count":24477643,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-10T02:00:08.965Z","response_time":71,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["helm","sigstore"],"created_at":"2024-08-04T08:00:53.066Z","updated_at":"2025-08-10T22:44:54.910Z","avatar_url":"https://github.com/sigstore.png","language":"Go","funding_links":[],"categories":["others","Go","Identity, signing and provenance"],"sub_categories":["Supply chain beyond libraries"],"readme":"# helm-sigstore\n\n[![Build Status](https://github.com/sigstore/helm-sigstore/workflows/ci/badge.svg?branch=main)](https://github.com/sigstore/helm-sigstore/actions?workflow=ci)\n[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/helm-sigstore)](https://artifacthub.io/packages/search?repo=helm-sigstore)\n[![SLSA](https://slsa.dev/images/gh-badge-level3.svg)](https://slsa.dev/)\n\nPlugin for [Helm](https://helm.sh/) to integrate the [sigstore](https://sigstore.dev/) ecosystem. Search, upload and verify signed Helm Charts in the [Rekor](https://github.com/sigstore/rekor) Transparency Log.\n\n## Info\n\nhelm-sigstore is developed as part of the [`sigstore`](https://sigstore.dev) project.\n\nWe also use a [slack channel](https://sigstore.slack.com)!\nClick [here](https://join.slack.com/t/sigstore/shared_invite/zt-mhs55zh0-XmY3bcfWn4XEyMqUUutbUQ) for the invite link.\n\n## Installation\n\nUse the following steps to build the `helm-sigstore` binary and install it as a Helm Plugin\n\n### Building\n\nOn a system with [Go](https://golang.org/) installed, execute the following to download the source and build the plugin\n\n```shell\n$ mkdir -p $GOPATH/src/github.com/sigstore\n$ cd $GOPATH/src/github.com/sigstore\n$ git clone https://github.com/sigstore/helm-sigstore.git\n$ cd helm-sigstore\n```\n\nBuild the plugin\n\n```shell\n$ make\n```\n\nThe plugin binary will be available in the `bin` directory\n\n### Plugin Installation\n\nBefore installing `helm-sigstore` as a Helm plugin, ensure that Helm is installed and configured on your machine. Then install the plugin.\n\n```shell\n$ helm plugin install https://github.com/sigstore/helm-sigstore\n```\n\nConfirm the plugin is available in Helm\n\n```\n$ helm plugin list\n\nNAME            VERSION         DESCRIPTION\nsigstore        0.1.0           This plugin integrates Helm into the Sigstore ecosystem.\n```\n\nWith the installation complete and successful, the plugin can be invoked through the `helm sigstore` command\n\n```shell\n$ helm sigstore\n\nIntegrates sigstore with Helm\n\nUsage:\n  sigstore [command]\n...\n```\n\n## Quickstart\n\nThis brief example demonstrates how to upload a signed Helm chart to Rekor and validate the entry\n\n### Upload a Signed Helm Chart\n\n```\n$ helm sigstore upload \u003cpath_to_packaged_chart\u003e\n\nCreated Helm entry at index 6821, available at: https://rekor.sigstore.dev/api/v1/log/entries/b30a142ef6c8b0480cd3e081fc99bc3d2a1a50ef60f68749c983a1479be6c4b9\n```\n\n_NOTE_: The provenance file must be located in the same directory as the packaged chart.\n\u003e To generate a provenance file, please consult the official documentation of [Helm Provenance and Integrity](https://helm.sh/docs/topics/provenance/).\n\n### Verify the Signed Chart from Rekor\n\nUse the same signed Helm chart from the prior section to verify the entry in Rekor\n\n```shell\nhelm sigstore verify \u003cpath_to_packaged_chart\u003e\nChart Verified Successfully From Helm entry:\n\nRekor Server: https://rekor.sigstore.dev\nRekor Index: 6821\nRekor UUID: b30a142ef6c8b0480cd3e081fc99bc3d2a1a50ef60f68749c983a1479be6c4b9\n```\n\nSee the [Usage documentation](USAGE.md) for detailed explanations and additional options.\n\n## SLSA Provenance\nThis project generates SLSA provenance for its releases! This enables you to verify the integrity\nof the downloaded artifacts and ensure that the binary's code really comes from this source code.\n\nTo verify the provenance of the release binaries, please follow the instructions [here](https://github.com/slsa-framework/slsa-github-generator#verification-of-provenance).\n\n## Security\n\nShould you discover any security issues, please refer to sigstores [security\nprocess](https://github.com/sigstore/community/blob/main/SECURITY.md)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsigstore%2Fhelm-sigstore","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsigstore%2Fhelm-sigstore","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsigstore%2Fhelm-sigstore/lists"}