From 2d978d2c5780c6f5b2c28202c96f2d497573f756 Mon Sep 17 00:00:00 2001
From: alehhu <159355663+alehhu@users.noreply.github.com>
Date: Mon, 3 Aug 2026 08:52:03 +0200
Subject: [PATCH] feat(plugin): support ascii-armored bare public keys for
 verification

Fixes #32500

Signed-off-by: alehhu <159355663+alehhu@users.noreply.github.com>
---
 pkg/provenance/sign.go                        | 13 +++++++-
 pkg/provenance/sign_test.go                   | 12 +++++++
 pkg/provenance/testdata/helm-test-key.pub.asc | 31 +++++++++++++++++++
 3 files changed, 55 insertions(+), 1 deletion(-)
 create mode 100644 pkg/provenance/testdata/helm-test-key.pub.asc

diff --git a/pkg/provenance/sign.go b/pkg/provenance/sign.go
index 90b7559e5..d5427cbac 100644
--- a/pkg/provenance/sign.go
+++ b/pkg/provenance/sign.go
@@ -363,7 +363,18 @@ func loadKeyRing(ringpath string) (openpgp.EntityList, error) {
 		return nil, err
 	}
 	defer f.Close()
-	return openpgp.ReadKeyRing(f)
+
+	// Try reading as binary keyring first (legacy behavior)
+	ring, err := openpgp.ReadKeyRing(f)
+	if err == nil {
+		return ring, nil
+	}
+
+	// Reset file pointer and try reading as armored keyring (e.g. for bare public keys like .asc)
+	if _, err := f.Seek(0, 0); err != nil {
+		return nil, err
+	}
+	return openpgp.ReadArmoredKeyRing(f)
 }
 
 // DigestFile calculates a SHA256 hash (like Docker) for a given file.
diff --git a/pkg/provenance/sign_test.go b/pkg/provenance/sign_test.go
index ec6e6194b..af8bf50aa 100644
--- a/pkg/provenance/sign_test.go
+++ b/pkg/provenance/sign_test.go
@@ -143,6 +143,18 @@ func TestLoadKeyRing(t *testing.T) {
 	}
 }
 
+func TestLoadKeyRingArmored(t *testing.T) {
+	k, err := loadKeyRing(testPubfile + ".asc")
+	require.NoError(t, err)
+
+	assert.LessOrEqualf(t, len(k), 1, "Expected 1, got %d", len(k))
+
+	for _, e := range k {
+		ii, ok := e.Identities[testKeyName]
+		assert.Truef(t, ok, "Expected %s in %v", testKeyName, ii)
+	}
+}
+
 func TestDigest(t *testing.T) {
 	f, err := os.Open(testChartfile)
 	require.NoError(t, err)
diff --git a/pkg/provenance/testdata/helm-test-key.pub.asc b/pkg/provenance/testdata/helm-test-key.pub.asc
new file mode 100644
index 000000000..7e732481f
--- /dev/null
+++ b/pkg/provenance/testdata/helm-test-key.pub.asc
@@ -0,0 +1,31 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: Use "gpg --dearmor" for unpacking
+
+mQENBFeWbZ4BCADIsgNRyVBSWJkbH6h3UWWXsA9ce1u+YKvaCYFSjIujKycTAqCC
+P7qUV2Oj/4E2zUcOD1/8/meDwuTnNTLzdSw4ujtFlKRSw7zelQE6sxvID0KM0pQK
+7AxDTXsm/7Afd/fg4WNW0/hcbeiNz4TVmSWAnbqeLg8o8eljR5QhTk47H6Glo4hV
+raeLCKG77qm2qOQ/m38ec+L5n9iUpoZZu1S5RXPUIanV5pLlx2rQsooIQEdJbTRF
+Iv3+2Nj/56PFVdrw7E5ARqCD4PpzzYV7uj8vKumOp+VivFj95Ze6DFENh1WWy336
+jQEj0uTolgOYeQ6AdJobwSPUeYXGV6Sf2vwXABEBAAG0XUhlbG0gVGVzdGluZyAo
+VGhpcyBrZXkgc2hvdWxkIG9ubHkgYmUgdXNlZCBmb3IgdGVzdGluZy4gRE8gTk9U
+IFRSVVNULikgPGhlbG0tdGVzdGluZ0BoZWxtLnNoPokBNwQTAQoAIQUCV5ZtngIb
+AwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRCEO7+YH8GHYolFCAC0+ejT5dIX
+0juRl5AdG6XAlEf9IrehkVlo0s5bG1Ucea9jjNRafmmHyMravrxZVI9zGFhaNpxA
++McnnWAO8lx5yTgnGW269qvFBsj5n0ItPewILQZjTEgwLYf1oc2qCFpk+8ovBnxZ
+Kaz3J5QKqU09zLO2yALuI5FTCCUupJ3OGIrKvLJ4H2jsRk/5jgqIgqJotW/4Baza
+4zemFdQHj9FPvq9sVeW5lyxM48i638GtslIgc0y2Yd/bfiy0tfIkskWz/kS1U6c9
+Utr3UPwpBqHjXnakmpK7GMGlp5eDXgr63BEdLKxJJWWxIys35fR19XZXcAELrwMh
+zkTzB/dvI375uQENBFeWbZ4BCADB6a8oiF2royWbvwmujBxSmD68QWziNZbSCuRs
+M4WM1iy69kspJHRwJEVIE5pkoVfV6tIcwQQ0VkJmq6Pf/pyKeMAXp0u8bp5K0mVE
+Yio1/adiLM3kX1yleoXLNUb1gNvsk6Kp6BZCUNRmjKlbKxapJKHmL+opX8UoeLeE
+KSgJNL8jvo3nRgg+wIPnVDoizz7y03F0k4SbgNGdoA/FtZs/vcSrEfzOLgI2RxQS
+dj/ePkxg9TvQygUSYgAVbYlASw6XMmd/zTjkfD9qa0l3WSejTisn85b611WryDpA
+iYkYC3GzK8g7S9VwkAbtr79cbG+1djlA4aHASpil+zR12yEhABEBAAGJAR8EGAEK
+AAkFAleWbZ4CGwwACgkQhDu/mB/Bh2LbNQgAiOOMNzmKzY4A7/ra8ppaH9oL8XIa
+WvInivOsx22K09PPuPVqi/ooBiRGyRqhdVS4ShPOoOTR5tOsdfPpEMTHnGQ1+jW+
+Tw5MXv3oMckWw3YEYptnuvon3wT4bOXLr+eYlY4Z1ONs+pAXwMiQ2zXNuKHpA2fR
+HsF8Wyw57rCVn7K5nQgZCbVxasYlzvFGnmt/itSC5w/AnIvICDOWcoGFKTieqhME
+IkCyvu+DNrMAumnD2fqF2olsM4IzCEPSMEQqJIGzZTtQTseS8NSDioRGnG1AJQ94
+BssQVmTh0/hlpoTqXY803lR5wb1fr3RRnkOu+lbEI6AAUj51j5TAAo/1dA==
+=bvcV
+-----END PGP PUBLIC KEY BLOCK-----