SonarQube Helm Chart PGP Signature/Provenance Layer

SonarQube Server / Community Build
1

Hello,

I am trying to deploy SonarQube server using helm charts.
I noticed that the helm chart for Sonarqube is not signed and nor does it have a link to the PGP key.

I am using this link to download the chart:
Artifact Hub Link

Would it be possible for the team maintaining the chart to add a signature/provenance layer to it?
Helm Provenance

For example as done in this chart:
Example

That way every time a helm pull , upgrade or install command needs to be run, the --verify flag can be used to check the integrity of the helm chart package.

1 Like
4

Hello @j.b thanks a lot for this feedback, this is indeed a very good feature we could implement.

I’ll create a ticket to track the progress of it. Nonetheless please do not expect an ETA for now.

Regards,
Jérémy.

5

For posterity, here is that ticket: SONAR-24735

8

I think it’s also related to Provide helm-chart-sonarqube to OCI compatible registry

Since OCI provide a way to attach artifact together (like SBOM, attestation etc…)

1 Like