Verifying Helm Releases
Helm Chart Verification
Corsha signs all Helm Charts allowing customers to verify the provenance of the charts. To verify that you are installing signed and trustworthy artifacts, you'll first need to import the public Corsha signing key.
Importing the Corsha Release Signing Key
First, download Corsha's public signing key, accessible through the Signing Key Download Page.
After downloading, import the public key and then export your public keyring into the .gpg format, allowing Helm to read the keychain.
gpg --import corsha-signing-key.asc
gpg --export >~/.gnupg/pubring.gpg
Validating Helm Charts
To validate Corsha's Helm Charts before installation, append the --verify flag to your helm upgrade or helm install command.
Resolving Helm Verification Issues
If any Helm command returns the error Error: openpgp: signature made by unknown entity, then you likely had an old signing key in your GPG keyring. To resolve this issue, you will need to delete the old key and re-import the current key.
gpg --delete-key E57015DC4E01F731490FA72CA3A3A5BA52C02BC1
gpg --import corsha-signing-key.asc
gpg --export >~/.gnupg/pubring.gpg