SonarQube Helm Chart PGP Signature/Provenance Layer

SonarQube Server / Community Build
1

Hello,

I am trying to deploy SonarQube server using helm charts.
I noticed that the helm chart for Sonarqube is not signed and nor does it have a link to the PGP key.

I am using this link to download the chart:
Artifact Hub Link

Would it be possible for the team maintaining the chart to add a signature/provenance layer to it?
Helm Provenance

For example as done in this chart:
Example

That way every time a helm pull , upgrade or install command needs to be run, the --verify flag can be used to check the integrity of the helm chart package.

1 Like
4

Hello @j.b thanks a lot for this feedback, this is indeed a very good feature we could implement.

I’ll create a ticket to track the progress of it. Nonetheless please do not expect an ETA for now.

Regards,
Jérémy.