Admaing opened a new pull request, #1210: URL: https://github.com/apache/flink-kubernetes-operator/pull/1210
## What is the purpose of the change Closes [FLINK-38798](https://issues.apache.org/jira/browse/FLINK-38798). The released Helm chart archive (`flink-kubernetes-operator-<OPERATOR-VERSION>-helm.tgz`) was published without a Helm provenance file, so users had no way to check the origin and the integrity of the chart with the standard Helm tooling. The release directory already carries a GPG `.asc` signature for the archive, but `.asc` is not the format `helm verify` / `helm install --verify` consume. This change makes the release script publish `flink-kubernetes-operator-<OPERATOR-VERSION>-helm.tgz.prov` next to the archive, so the chart can be verified with `helm verify` and `helm install --verify`. ## Brief change log - `tools/releasing/create_source_release.sh` now creates a Helm provenance file for the packaged chart, clear-signed with the same release key that already signs the `.asc` files. - `SHA256SUM` is resolved alongside the existing `SHASUM`. - The Helm operations page documents how to verify the released chart (en + zh). ## Verifying this change This change is already covered by existing tests, such as the release script itself, and was verified end to end manually as follows: - Ran `tools/releasing/create_source_release.sh` with a test signing key. `helm verify --keyring <keyring> flink-kubernetes-operator-9.9.9-helm.tgz` prints `Chart Hash Verified`. - Appending a byte to the archive makes `helm verify` fail with `sha256 sum does not match`. - Removing the `.prov` file makes `helm verify` fail; an unrelated keyring fails with `signature made by unknown entity`. - Confirmed the Apache license header is still present in `Chart.yaml` inside the archive, and that `helm repo index` still produces a populated `index.yaml`. Note on the implementation: `helm package --sign` cannot be used here, because `helm package` rewrites `Chart.yaml` and drops the ASF license header (see FLINK-27747), which is why the release script packages the chart with `tar`. The provenance file is therefore produced with `gpg --clearsign`, using the message format Helm expects. ## Does this pull request potentially affect one of the following parts: - Dependencies (does it add or upgrade a dependency): no - The public API, i.e., is any changes to the `CustomResourceDescriptors`: no - Core observer or reconciler logic that is regularly executed: no ## Documentation - Does this pull request introduce a new feature? yes - If yes, how is the feature documented? docs -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
