Signing a Chart with helm package --sign
Producing a .prov file with your GPG key.
Signing a Chart with helm package --sign is a free Helm Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Helm Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Signing at Package Time
You sign a chart in the same step that packages it. Adding --sign to helm package produces both the .tgz and its .prov together.
helm package --sign ./mychartYou Need a GPG Key First
Signing requires a private GPG key. If you do not have one, generate it with gpg before you ever try to sign a chart.
gpg --full-generate-keyPick the Key to Sign With
Tell Helm which identity to use with --key, giving a name or email that matches a private key in your keyring.
helm package --sign --key "Jane Dev" ./mychartPoint at the Keyring File
Helm reads keys from a binary keyring file. Use --keyring to point at it, often your exported secret keys.
--keyring ~/.gnupg/secring.gpgModern GPG Needs Export
GPG 2.1+ dropped the old secring.gpg. Export your secret keys to a file Helm can read before signing.
gpg --export-secret-keys > ~/.gnupg/secring.gpgWhat Gets Signed
Helm hashes the freshly built .tgz, adds the chart metadata, and wraps it all in a signature made with your private key.
The Passphrase Prompt
If your key is protected, Helm prompts for its passphrase during signing. This unlocks the private key just long enough to sign.
Two Files Out
A successful signed package writes the archive and its companion .prov side by side, both named for the chart and version.
mychart-0.1.0.tgz
mychart-0.1.0.tgz.provInspect the Signature
Use helm verify on the freshly signed archive to confirm the .prov is valid before you publish anything.
helm verify mychart-0.1.0.tgzShare Your Public Key
Others verify with your public key, not your private one. Export and publish it so consumers can trust your signatures.
gpg --export 'Jane Dev' > janedev.pubSign in Automation
In CI, avoid interactive prompts by using a key with a known passphrase fed from a secret, keeping the private key out of the repo.
Quick Check
You want to produce a signed chart archive with its provenance file in one command.
Recap: Signing Charts
You added --sign and --key to helm package, using a GPG key from your keyring. The result is a signed .tgz plus a matching .prov. 🔑
Frequently asked questions
Is the “Signing a Chart with helm package --sign” lesson free?
Yes — the full text of “Signing a Chart with helm package --sign” is free to read here on the web, and the Helm Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Helm Academy course, upgrade to CoddyKit PRO.
What will I learn in “Signing a Chart with helm package --sign”?
Producing a .prov file with your GPG key. You practise Helm Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Helm Academy?
No prior experience is required. Helm Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Signing a Chart with helm package --sign” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Helm Academy lesson?
Yes. Every Helm Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- What a Provenance File Guarantees
- Signing a Chart with helm package --sign
- Verifying with helm verify and --verify
- Keyless Signing with Sigstore Cosign