Verifying with helm verify and --verify
Rejecting charts that fail the signature check.
Verifying with helm verify and --verify is a free DevOps Bootcamp lesson on CoddyKit. This is lesson 3 of 4. Any 3 lessons of this learning path are free to read in full — after that, CoddyKit PRO unlocks every lesson, plus hands-on practice with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, and your progress syncs across the web and the CoddyKit app. The DevOps Bootcamp course includes 4 lessons in total.
Checking the Signature
Signing is only half the story. The consumer's job is to verify that the chart and its .prov agree before trusting it.
The verify Command
Run helm verify against a downloaded .tgz that already has its .prov beside it. Helm checks both the hash and the signature.
helm verify mychart-0.1.0.tgzYou Need the .prov Present
helm verify expects the .prov file next to the archive. Without it, there is no signature to check and verification cannot run.
mychart-0.1.0.tgz
mychart-0.1.0.tgz.provSupply the Signer's Public Key
Verification needs the publisher's public key in your keyring. Point Helm at it with --keyring if it is not the default.
helm verify --keyring ./pubring.gpg mychart-0.1.0.tgzTwo Checks, Both Must Pass
Helm recomputes the archive's digest and validates the PGP signature. If either fails, verification errors out and you should not install.
Verify While Installing
You do not need a separate step. Add --verify to install or pull and Helm refuses to proceed if the signature is bad.
helm install demo ./mychart-0.1.0.tgz --verifyVerify a Repo Chart
When installing from a repo, --verify tells Helm to download the .prov too and check it before the release is created.
helm install demo myrepo/mychart --verifyReading a Success
On success Helm prints the Signed by identity and the SHA-256 hash it confirmed, so you can see exactly who and what you trusted.
Signed by: Jane Dev <jane@example.com>
Using Key With Fingerprint: ABC123...Missing Key Fails Loudly
If the signer's public key is not in your keyring, verification fails. Helm cannot validate a signature it has no key for.
Import the Key First
Fetch and import the publisher's public key into your keyring, then verification has something to check the signature against.
gpg --import janedev.pubMake It a Habit
For untrusted sources, verifying before install is your defense against tampered or impersonated charts reaching your cluster.
Quick Check
You want Helm to refuse the install if a downloaded chart's signature is invalid.
Recap: Verifying Charts
Use helm verify or the --verify flag to confirm a chart's digest and signature against the signer's public key before installing. ✅
Learn DevOps Bootcamp with an AI tutor — free
Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.
- Courses
- 142
- Lessons
- 568
Frequently Asked Questions
Is the “Verifying with helm verify and --verify” lesson free?
Yes — any 3 lessons of the DevOps Bootcamp learning path, including “Verifying with helm verify and --verify”, are free to read in full here on the web. After that, CoddyKit PRO unlocks every lesson, plus interactive practice with a built-in code editor and a 24/7 AI tutor. The DevOps Bootcamp course includes 4 lessons in total.
What will I learn in “Verifying with helm verify and --verify”?
Rejecting charts that fail the signature check. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start DevOps Bootcamp?
No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 3 of 4.
How long does the “Verifying with helm verify and --verify” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this DevOps Bootcamp lesson?
Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- What a Provenance File Guarantees
- Signing a Chart with helm package --sign
- Verifying with helm verify and --verify
- Keyless Signing with Sigstore Cosign