* fix(provenance): support GnuPG keybox (pubring.kbx) keyrings
Starting with GnuPG 2.1, file-backed public keyrings can use
~/.gnupg/pubring.kbx instead of the legacy pubring.gpg. Helm only read
the legacy format, so chart and plugin verification failed on
installations using the file-backed keybox.
Make the keyring loader format-aware:
- GnuPG keybox (pubring.kbx): extract OpenPGP keyblocks from the
keybox container without adding a dependency. Skip ephemeral blobs,
matching GnuPG's own read behavior.
- ASCII-armored keyrings: load single or concatenated exports.
- Legacy binary packet streams (pubring.gpg): retain the existing path.
defaultKeyring() falls back to pubring.kbx when pubring.gpg is absent.
pubring.gpg keeps precedence when both files exist.
This change covers file-backed public keyrings. It does not read the
SQLite database used by keyboxd, which needs a separate design.
Related to #31836
Signed-off-by: Ruslan Shaydullin <shaydullin.r.d@outlook.com>
* fix(provenance): treat only not-exist as keyring absence in defaultKeyring
A stat error other than 'not exist' (e.g. a permission problem) meant
the file may well be present, but defaultKeyring() skipped past it: an
unreadable pubring.gpg silently lost precedence to pubring.kbx, and the
surfaced error could point at the wrong file. Treat only fs.ErrNotExist
as absence. For any other stat error, return that path unchanged so the
real error surfaces when the keyring is opened.
Signed-off-by: Ruslan Shaydullin <shaydullin.r.d@outlook.com>
---------
Signed-off-by: Ruslan Shaydullin <shaydullin.r.d@outlook.com>
Co-authored-by: George Jenkins <gvjenkins@gmail.com>
At this time both Go 1.19 and 1.20 are supported. The version
specified in the go.mod file is the minimum version we expect Helm
to be compiled against. This is the oldest supported version to
support environments where others compile Helm. The Helm project
is using Go 1.20 to build Helm itself.
Updating to Go 1.19 also includes dealing with io/ioutil
deprecation and some additional linting issues around staticcheck.
All the staticcheck issues were in test files so linting was
skipped for those.
Signed-off-by: Matt Farina <matt.farina@suse.com>
Before this change, several of the potential errors during the process
of signing a package were skipped.
Crucially, `Close()`ing the ReadCloser from the gpg clearsigner is the call
which actually does the signing, and so has several points of failure
which are ignored; for example, if there's a problem with the format of
the key.
Also changes the error from messageBlock() to be propagated rather than
being swallowed, and adds a test for the case where a signer fails to
sign.
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
This removes the requirement that a fetch or install command must
explicitly state the version number to install. Instead, this goes to
the strategy used by OS package managers: Install the latest until told
to do otherwise.
Closes#1198
This adds the --verify and --keyring flags to:
helm fetch
helm inspect
helm install
helm upgrade
Each of these commands can now make cryptographic verification a
prerequisite for using a chart.
This adds support for OpenPGP signatures containing provenance data.
Such information can be used to verify the integrity of a Chart by
testing that its file hash, metadata, and images are correct.
This first PR does not contain all of the tooling necessary for
end-to-end chart integrity. It contains just the library.
See #983
Ruslan Shaydullin
Matthieu MOREL
Terry Howe
Siew Kam Onn
Scott Rigby
wangjingcun
Robert Sirchia
Matt Farina
Ashley Davis
Josh Dolitsky
Adam Reese
Matt Butcher
Matt Butcher