-
Notifications
You must be signed in to change notification settings - Fork 14
Description
Description
Context: I was investigating unused types in sigstore/rekor#2080, and helm had some usage but not a significant amount. One of the blockers to deprecating support would be to migrate over any Sigstore clients away from the deprecated kinds.
helm-sigstore uploads helm kinds here. Instead, we can switch to uploading hashedrekord kinds. It would be straightforward to do - Instead of uploading the chart, you would upload a) a hash of the chart, b) the pgp signature, c) the pgp key. Verification would change from verifying the helm entry to verifying the hashedrekord entry.
There is a blocker on Rekor's side, as we only support public keys or certificates for hashedrekord records currently. It would be straightforward for us to add support, as we do in rekord already.