Helm in Practice

Publishing a Signed Chart to a Repository

If you are using a classic chart repository (like an S3 bucket, HTTP server, or similar), you need to upload both the signed chart package (.tgz) and the provenance file (.tgz.prov) to the repository.

For example, if you are using an S3 bucket as your chart repository, you can use the AWS CLI to upload both files:

aws s3 cp hello-world-0.1.0.tgz s3://my-helm-charts/
aws s3 cp hello-world-0.1.0.tgz.prov s3://my-helm-charts/

In general, if the URL of a package is https://example.com/charts/mychart-1.2.3.tgz, the provenance file should be accessible at https://example.com/charts/mychart-1.2.3.tgz.prov