Verifying with helm verify and --verify
Rejecting charts that fail the signature check.
Verifying with helm verify and --verify is a free Helm Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Helm Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Checking the Signature
Signing is only half the story. The consumer's job is to verify that the chart and its .prov agree before trusting it.
The verify Command
Run helm verify against a downloaded .tgz that already has its .prov beside it. Helm checks both the hash and the signature.
helm verify mychart-0.1.0.tgzYou Need the .prov Present
helm verify expects the .prov file next to the archive. Without it, there is no signature to check and verification cannot run.
mychart-0.1.0.tgz
mychart-0.1.0.tgz.provSupply the Signer's Public Key
Verification needs the publisher's public key in your keyring. Point Helm at it with --keyring if it is not the default.
helm verify --keyring ./pubring.gpg mychart-0.1.0.tgzTwo Checks, Both Must Pass
Helm recomputes the archive's digest and validates the PGP signature. If either fails, verification errors out and you should not install.
Verify While Installing
You do not need a separate step. Add --verify to install or pull and Helm refuses to proceed if the signature is bad.
helm install demo ./mychart-0.1.0.tgz --verifyVerify a Repo Chart
When installing from a repo, --verify tells Helm to download the .prov too and check it before the release is created.
helm install demo myrepo/mychart --verifyReading a Success
On success Helm prints the Signed by identity and the SHA-256 hash it confirmed, so you can see exactly who and what you trusted.
Signed by: Jane Dev <jane@example.com>
Using Key With Fingerprint: ABC123...Missing Key Fails Loudly
If the signer's public key is not in your keyring, verification fails. Helm cannot validate a signature it has no key for.
Import the Key First
Fetch and import the publisher's public key into your keyring, then verification has something to check the signature against.
gpg --import janedev.pubMake It a Habit
For untrusted sources, verifying before install is your defense against tampered or impersonated charts reaching your cluster.
Quick Check
You want Helm to refuse the install if a downloaded chart's signature is invalid.
Recap: Verifying Charts
Use helm verify or the --verify flag to confirm a chart's digest and signature against the signer's public key before installing. ✅
Frequently asked questions
Is the “Verifying with helm verify and --verify” lesson free?
Yes — the full text of “Verifying with helm verify and --verify” is free to read here on the web, and the Helm Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Helm Academy course, upgrade to CoddyKit PRO.
What will I learn in “Verifying with helm verify and --verify”?
Rejecting charts that fail the signature check. You practise Helm Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Helm Academy?
No prior experience is required. Helm Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Verifying with helm verify and --verify” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Helm Academy lesson?
Yes. Every Helm Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- What a Provenance File Guarantees
- Signing a Chart with helm package --sign
- Verifying with helm verify and --verify
- Keyless Signing with Sigstore Cosign