Admaing opened a new pull request, #1210:
URL: https://github.com/apache/flink-kubernetes-operator/pull/1210

   ## What is the purpose of the change
   
   Closes [FLINK-38798](https://issues.apache.org/jira/browse/FLINK-38798).
   
   The released Helm chart archive 
(`flink-kubernetes-operator-<OPERATOR-VERSION>-helm.tgz`) was published
   without a Helm provenance file, so users had no way to check the origin and 
the integrity of the chart
   with the standard Helm tooling. The release directory already carries a GPG 
`.asc` signature for the
   archive, but `.asc` is not the format `helm verify` / `helm install 
--verify` consume.
   
   This change makes the release script publish 
`flink-kubernetes-operator-<OPERATOR-VERSION>-helm.tgz.prov`
   next to the archive, so the chart can be verified with `helm verify` and 
`helm install --verify`.
   
   ## Brief change log
   
   - `tools/releasing/create_source_release.sh` now creates a Helm provenance 
file for the packaged chart,
     clear-signed with the same release key that already signs the `.asc` files.
   - `SHA256SUM` is resolved alongside the existing `SHASUM`.
   - The Helm operations page documents how to verify the released chart (en + 
zh).
   
   ## Verifying this change
   
   This change is already covered by existing tests, such as the release script 
itself, and was verified
   end to end manually as follows:
   
   - Ran `tools/releasing/create_source_release.sh` with a test signing key.
     `helm verify --keyring <keyring> flink-kubernetes-operator-9.9.9-helm.tgz` 
prints `Chart Hash Verified`.
   - Appending a byte to the archive makes `helm verify` fail with `sha256 sum 
does not match`.
   - Removing the `.prov` file makes `helm verify` fail; an unrelated keyring 
fails with
     `signature made by unknown entity`.
   - Confirmed the Apache license header is still present in `Chart.yaml` 
inside the archive, and that
     `helm repo index` still produces a populated `index.yaml`.
   
   Note on the implementation: `helm package --sign` cannot be used here, 
because `helm package` rewrites
   `Chart.yaml` and drops the ASF license header (see FLINK-27747), which is 
why the release script packages
   the chart with `tar`. The provenance file is therefore produced with `gpg 
--clearsign`, using the message
   format Helm expects.
   
   ## Does this pull request potentially affect one of the following parts:
   
     - Dependencies (does it add or upgrade a dependency): no
     - The public API, i.e., is any changes to the `CustomResourceDescriptors`: 
no
     - Core observer or reconciler logic that is regularly executed: no
   
   ## Documentation
   
     - Does this pull request introduce a new feature? yes
     - If yes, how is the feature documented? docs
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to