It proves two things: the chart archive has not been changed since it was signed, and it was signed by a key in your keyring. It does not prove the chart is safe or that you should trust the signer. Verification is only as good as your decision about whose key to accept.
How Helm provenance works
Helm can generate and verify signature files. A chart package such as myapp-1.2.3.tgz has a matching myapp-1.2.3.tgz.prov file. The provenance file contains the chart's Chart.yaml, a map of file names to SHA-256 digests, and a PGP signature over the whole body.
The Helm documentation lists the assurances this gives:
- The package has not been tampered with, via the checksum of the .tgz file.
- The entity who released it is known, via the signature.
The commands
The publisher signs when packaging:
helm package --sign --key 'Key Name' --keyring path/to/keyring.secret mychart
A consumer can check a local archive with helm verify, or verify during install with the verify flag on helm install. The reference adds that if verify is set, the chart must have a provenance file and the file must pass all verification steps. If the signer's public key is not in the default keyring location, point to it with the keyring option.
Why a chart may fail to verify
The documentation lists the causes:
- The .prov file is missing or corrupt, which suggests something is wrong.
- The signing key is not in your keyring, so you have not signalled trust in that signer.
- The .prov verification itself failed.
- The checksum in the .prov file does not match the archive, which indicates tampering.
A failed check is a reason to distrust the package.
What it cannot tell you
- Whether the chart is safe. A signed chart can still ask for privileged containers or pull a bad image. Run policy checks on the rendered output.
- Whether the signer deserves trust. Helm deliberately does not act as a certificate authority. The documentation says establishing the signer's authority is left to you, and that the system hinges on trusting the person who signed.
- Whether the images are what you expect. Pin image digests in the chart values and verify those separately.
The documentation also mentions that provenance can be published to an immutable transparency log with a Sigstore upload command, which adds a public record.
A practical policy
- Decide which chart publishers you trust and import only their public keys.
- Require verification in CI for third party charts.
- Mirror approved charts into your own registry, and verify at the mirror.
- Still render and policy check every chart, signed or not.
Quick check
Does a verified chart mean it is safe to install?
No. It means the file is unchanged and signed by a key you hold. The contents still need review and policy checks.
Does verify work without a provenance file?
No. With verify set, the chart must have a provenance file that passes all steps.
Safeguard runs policies and gates on pull requests, so a failed rule can hold a merge, and its dependency and SBOM scanning covers the packages your infrastructure code pulls in. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
