Chart Provenance

As of Workflow v2.8.0, Deis has released Kubernetes Helm charts for Workflow and for each of its components.

Helm provides tools for establishing and verifying chart integrity. (For an overview, see the Provenance doc.) All release charts from the Deis Workflow team are now signed using this mechanism.

The full Deis, Inc. (Helm chart signing key) <[email protected]> public key can be found here, as well as the keyserver and the official Deis Keybase account. The key's fingerprint can be cross-checked against all of these sources.

Verifying a signed chart

The public key mentioned above must exist in a local keyring before a signed chart can be verified.

To add it to the default ~/.gnupg/pubring.gpg keyring, any of the following commands will work:

$ # via our hosted location
$ curl | gpg --import

$ # via the keyserver
$ gpg --keyserver --recv-keys 1D6A97D0

$ # via Keybase with account...
$ keybase follow deis
$ keybase pgp pull

$ # via Keybase by curl
$ curl | gpg --import

Charts signed with this key can then be verified when fetched:

$ helm repo add deis
"deis" has been added to your repositories

$ helm fetch --verify workflow/workflow --version v2.14.0
Verification: &{0xc4208f4b40 sha256:662b7b5f0101086b373a326aac8c505df3b230d377b926fc256b537a3471f2ad workflow-v2.14.0.tgz}

One can then inspect the fetched workflow-v2.14.0.tgz.prov provenance file.

If the chart was not signed, the command above would result in:

Error: Failed to fetch provenance ""

Alternatively, the chart can also be verified at install time:

$ helm install --verify deis/workflow --namespace deis
NAME:   exiled-mink
LAST DEPLOYED: Thu May  4 08:22:16 2017

$ helm ls
NAME        REVISION    UPDATED                     STATUS      CHART
exiled-mink 1           Thu May  4 08:22:16 2017    DEPLOYED    workflow-v2.14.0

Having done so, one is assured of the origin and authenticity of any installed Workflow chart released by Deis.