Skip to content

Switch to hashedrekord Rekor type #248

@haydentherapper

Description

@haydentherapper

Description

Context: I was investigating unused types in sigstore/rekor#2080, and helm had some usage but not a significant amount. One of the blockers to deprecating support would be to migrate over any Sigstore clients away from the deprecated kinds.

helm-sigstore uploads helm kinds here. Instead, we can switch to uploading hashedrekord kinds. It would be straightforward to do - Instead of uploading the chart, you would upload a) a hash of the chart, b) the pgp signature, c) the pgp key. Verification would change from verifying the helm entry to verifying the hashedrekord entry.

There is a blocker on Rekor's side, as we only support public keys or certificates for hashedrekord records currently. It would be straightforward for us to add support, as we do in rekord already.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions