Start signing Helm releases
Open
Nobody has claimed this yet.
security
- Dominant language
- Markdown
- Stars
- 46
- Forks
- 40
- Avg merge
- 4h 3m
- Merged PRs (30d)
- 6
Description
Helm supports signing and verifying chart releases with GPG, which is not as convenient as Cosign but might be better than nothing. To actually use GPG we will need:
- A key. I have some indication from SRE that we can expose RStudio's existing GPG key via GitHub Actions.
- To use chart-releaser's existing (but not widely advertised) GPG signing support.
- To update the README templates with a section explaining how users can verify these signatures.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the GitHub Actions workflow that publishes Helm releases and the README templates used for generated charts. Check chart-releaser's existing GPG signing support and determine how RStudio's GPG key can be exposed to Actions. Done means releases are signed and the README templates explain how users can verify the signatures.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- devops, documentation, release, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100