Plugin signing and verifying by scottrigby · Pull Request #6 · scottrigby/helm

scottrigby · 2025-07-25T12:58:18Z

This PR adds plugin signing, verifying and commands described in HIP 0026

to-do:

add this --verify option to OCI plugin installer #2

…mand type flag Signed-off-by: Scott Rigby <scott@r6by.com>

Signed-off-by: Scott Rigby <scott@r6by.com>

…e postrender Signed-off-by: Scott Rigby <scott@r6by.com>

…mplete: // NOTE(thomastaylor312): I am leaving this code commented out here. During // the implementation of post-render, it was brought up that if we are // relying on plugins, we should actually use the plugin system so it can // properly handle multiple OSs. This will be a feature add in the future, // so I left this code for reference. It can be deleted or reused once the // feature is implemented Signed-off-by: Scott Rigby <scott@r6by.com>

Signed-off-by: Scott Rigby <scott@r6by.com>

… unmarshall strict Signed-off-by: Scott Rigby <scott@r6by.com>

Signed-off-by: Scott Rigby <scott@r6by.com>

…pe (legacy plugins are either cli or download) Signed-off-by: Scott Rigby <scott@r6by.com>

Signed-off-by: Scott Rigby <scott@r6by.com>

fix nil pointer dereference for tests Signed-off-by: Scott Rigby <scott@r6by.com>

Signed-off-by: Scott Rigby <scott@r6by.com>

…subprocess and Wasm). Move fields to the applicable config structs. TODO update tests and testdata YAML to match Signed-off-by: Scott Rigby <scott@r6by.com>

…tch, and update tests to match Signed-off-by: Scott Rigby <scott@r6by.com>

Signed-off-by: Scott Rigby <scott@r6by.com>

…t but with the wrong value. Give better error instead Signed-off-by: Scott Rigby <scott@r6by.com>

…plugin.yaml fully if they set apiVersion to v1 Signed-off-by: Scott Rigby <scott@r6by.com>

Signed-off-by: Scott Rigby <scott@r6by.com>

… it's consistent) Signed-off-by: Scott Rigby <scott@r6by.com>

Signed-off-by: Scott Rigby <scott@r6by.com>

… way to preserve file mode for executables Signed-off-by: Scott Rigby <scott@r6by.com>

…update plugin OCI installer accordingly Signed-off-by: Scott Rigby <scott@r6by.com>

OCI plugin installer

…cy_downloader_convert Fix legacy metadata downloader convert

Signed-off-by: Scott Rigby <scott@r6by.com> fix plugin HTTP tarball support Signed-off-by: Scott Rigby <scott@r6by.com> fix plugin local tarball support Signed-off-by: Scott Rigby <scott@r6by.com> Plugin signing and provenance support Signed-off-by: Scott Rigby <scott@r6by.com> Add verify flag to plugin install Signed-off-by: Scott Rigby <scott@r6by.com> Add installed plugin provenance tracking, with errors, warnings, and info during plugin commands Signed-off-by: Scott Rigby <scott@r6by.com> Allow plugin verify cmd to verify directories for installed signed plugins Signed-off-by: Scott Rigby <scott@r6by.com> Replace tarball-based hashing with idempotent directory-based hashing Signed-off-by: Scott Rigby <scott@r6by.com> Fix plugin package --sign case where tarball was created even if no signing key was found Signed-off-by: Scott Rigby <scott@r6by.com> update plugin package command to sign by default. bypass with --sign=false. emit warning if so Signed-off-by: Scott Rigby <scott@r6by.com> Fix TestIsRemoteHTTPArchive caused by optimization added in commit 00cbd42 that changed the behavior of isRemoteHTTPArchive Signed-off-by: Scott Rigby <scott@r6by.com> Fix TestExtractPluginInSubdirectory test failure The test was failing with "destination already exists" error because it was calling installer.Install() directly without going through the InstallWithOptions wrapper that checks for existing installations. Added cleanup of the destination directory before installation to match the behavior of the wrapper function. Signed-off-by: Scott Rigby <scott@r6by.com>

Signed-off-by: Scott Rigby <scott@r6by.com>

gjenkins8 · 2025-08-13T15:35:17Z

+	shouldVerify := o.verify
+
+	// Check if this is a local directory installation (for development)
+	if localInst, ok := i.(*installer.LocalInstaller); ok && !localInst.SupportsVerification() {


should we skip verification for legacy plugins too?

the new codebase can sign legacy plugins too. I think we should encourage this with all plugins including legacy. Right now --verify defaults to true (users can bypass it with --verify=false and they get a warning).

gjenkins8 · 2025-08-13T15:36:18Z

 	}
+
+	// Also remove the .prov file if it exists
+	provFile := p.Dir() + ".prov"


Is this needed? The os.RemoveAll(p.Dir()) should clean up everything?

ah, no, the .prov file sits next to the plugin dir in the HELM_PLUGINS directory.

truncated example from my laptop now:

% ls -lah $(go run ./cmd/helm env HELM_PLUGINS) total 8 drwxr-xr-x@ 10 r6by staff 320B Aug 13 05:05 . drwxr-xr-x@ 3 r6by staff 96B Jan 21 2025 .. drwxr-xr-x@ 4 r6by staff 128B Aug 13 05:05 example-cli -rw-r--r--@ 1 r6by staff 897B Aug 13 05:05 example-cli.prov lrwxr-xr-x@ 1 r6by staff 83B Aug 13 01:54 example-extism-getter -> /Users/r6by/code/github.com/scottrigby/h4-simple-plugin-types/example-extism-getter lrwxr-xr-x@ 1 r6by staff 76B Aug 13 01:18 example-getter -> /Users/r6by/code/github.com/scottrigby/h4-simple-plugin-types/example-getter

scottrigby · 2025-08-30T22:16:26Z

this is complete in upstream helm/helm

…26-6061 backport of helm#32450 updated with: ``` go get google.golang.org/grpc@v1.82.1 go mod tidy ``` example actions failure: https://github.com/helm/helm/actions/runs/31733009013/job/94557780520 ``` Vulnerability #1: GO-2026-6061 Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc More info: https://pkg.go.dev/vuln/GO-2026-6061 Module: google.golang.org/grpc Found in: google.golang.org/grpc@v1.80.0 Fixed in: google.golang.org/grpc@v1.82.1 Example traces found: Error: #1: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Close Error: #2: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Header Error: #3: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Read Error: #4: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.RecvCompress Error: #5: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.TrailersOnly Error: #6: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Write Error: #7: pkg/action/lazyclient.go:49:17: action.lazyClient.init calls sync.Once.Do, which eventually calls transport.NewHTTP2Client Error: #8: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.Stream.ReadMessageHeader Error: #9: pkg/action/lazyclient.go:49:17: action.lazyClient.init calls sync.Once.Do, which eventually calls transport.http2Client.Close Error: #10: pkg/action/lazyclient.go:49:17: action.lazyClient.init calls sync.Once.Do, which eventually calls transport.http2Client.GracefulClose Error: #11: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.http2Client.NewStream ``` Signed-off-by: Scott Rigby <scott@r6by.com>

…26-6061 (helm#32536) backport of helm#32450 updated with: ``` go get google.golang.org/grpc@v1.82.1 go mod tidy ``` example actions failure: https://github.com/helm/helm/actions/runs/31733009013/job/94557780520 ``` Vulnerability #1: GO-2026-6061 Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc More info: https://pkg.go.dev/vuln/GO-2026-6061 Module: google.golang.org/grpc Found in: google.golang.org/grpc@v1.80.0 Fixed in: google.golang.org/grpc@v1.82.1 Example traces found: Error: #1: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Close Error: #2: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Header Error: #3: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Read Error: #4: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.RecvCompress Error: #5: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.TrailersOnly Error: #6: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Write Error: #7: pkg/action/lazyclient.go:49:17: action.lazyClient.init calls sync.Once.Do, which eventually calls transport.NewHTTP2Client Error: #8: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.Stream.ReadMessageHeader Error: #9: pkg/action/lazyclient.go:49:17: action.lazyClient.init calls sync.Once.Do, which eventually calls transport.http2Client.Close Error: #10: pkg/action/lazyclient.go:49:17: action.lazyClient.init calls sync.Once.Do, which eventually calls transport.http2Client.GracefulClose Error: #11: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.http2Client.NewStream ``` Signed-off-by: Scott Rigby <scott@r6by.com>

scottrigby added 30 commits July 10, 2025 23:59

simple plugin types. add cli type. download by type. plugins list com…

216f913

…mand type flag Signed-off-by: Scott Rigby <scott@r6by.com>

TODO for execRender

b7c5b6b

Signed-off-by: Scott Rigby <scott@r6by.com>

Replace --post-renderer arbitrary binary execution with plugin of typ…

6a1f9b9

…e postrender Signed-off-by: Scott Rigby <scott@r6by.com>

Move postrenderer package to plugins. combine and fix tests

d56aecb

Signed-off-by: Scott Rigby <scott@r6by.com>

Fix references to pkg/plugin

3adcac1

Signed-off-by: Scott Rigby <scott@r6by.com>

Fix TestPostRendererFlagSetOnce test

78089d5

Signed-off-by: Scott Rigby <scott@r6by.com>

Fix TestLoadPluginsForCompletion

169c955

Signed-off-by: Scott Rigby <scott@r6by.com>

Fix TestLoadPlugins

2351363

Signed-off-by: Scott Rigby <scott@r6by.com>

Fix linting

a67e147

Signed-off-by: Scott Rigby <scott@r6by.com>

List and use legacy plugins using the same Plugin struct and removing…

49f4c7e

… unmarshall strict Signed-off-by: Scott Rigby <scott@r6by.com>

Add Plugin interface in front of PluginLegacy and Pluginv1

8d30420

Signed-off-by: Scott Rigby <scott@r6by.com>

Disambiguate API version legacy from type. There is no more legacy ty…

9d0b5e1

…pe (legacy plugins are either cli or download) Signed-off-by: Scott Rigby <scott@r6by.com>

Validate PluginV1

8f762d3

Signed-off-by: Scott Rigby <scott@r6by.com>

Add apiVersion to test data

7223720

fix nil pointer dereference for tests Signed-off-by: Scott Rigby <scott@r6by.com>

TODO for testing

e8b8082

Signed-off-by: Scott Rigby <scott@r6by.com>

Comments and TODOs

9a10c03

Signed-off-by: Scott Rigby <scott@r6by.com>

Try Plugin Config interface and Config implementations per plugin type

ba1f8d8

Signed-off-by: Scott Rigby <scott@r6by.com>

Add Runtime and RuntimeConfig interfaces, and implement per runtime (…

305c4fa

…subprocess and Wasm). Move fields to the applicable config structs. TODO update tests and testdata YAML to match Signed-off-by: Scott Rigby <scott@r6by.com>

Attempt to reorganize fields to make sense on new structs, YAML to ma…

9018a66

…tch, and update tests to match Signed-off-by: Scott Rigby <scott@r6by.com>

pkg/plugin tests pass

63ca138

Signed-off-by: Scott Rigby <scott@r6by.com>

Fix TestLoadPlugins. All tests pass now

01963be

Signed-off-by: Scott Rigby <scott@r6by.com>

Do not attept to unmarshall into PluginLegacy if apiVersion is presen…

4a75ff6

…t but with the wrong value. Give better error instead Signed-off-by: Scott Rigby <scott@r6by.com>

Remove legacy field fallback for PluginV1. Users should update their …

079df46

…plugin.yaml fully if they set apiVersion to v1 Signed-off-by: Scott Rigby <scott@r6by.com>

Reorganize code into separate files for better readability

2b54eb9

Signed-off-by: Scott Rigby <scott@r6by.com>

fix runHook

458ca64

Signed-off-by: Scott Rigby <scott@r6by.com>

Add plugin sourceURL

7076b52

Signed-off-by: Scott Rigby <scott@r6by.com>

Change CLI plugin config to match cobra options

a3bc64a

Signed-off-by: Scott Rigby <scott@r6by.com>

Fix tests after updating shortHelp, longHelp and usage fields

49332b0

Signed-off-by: Scott Rigby <scott@r6by.com>

add missing newlines at EOF

ae7c794

Signed-off-by: Scott Rigby <scott@r6by.com>

scottrigby and others added 18 commits August 5, 2025 02:18

Integrate draft PR Convert post-renderer to invoke #9

a7c8cc8

Signed-off-by: Scott Rigby <scott@r6by.com>

revert back to postrenderER (for the record I dislike this, but agree…

0d63f0a

… it's consistent) Signed-off-by: Scott Rigby <scott@r6by.com>

Change some naming

b48457f

Signed-off-by: Scott Rigby <scott@r6by.com>

Fix make test-style (goimports/golangci-lint) errors

bd5ebba

Signed-off-by: Scott Rigby <scott@r6by.com>

OCI installer for plugins

a77dd11

Signed-off-by: Scott Rigby <scott@r6by.com>

Simplify. We only want to support tarballs. This is the only reliable…

4ac9fd4

… way to preserve file mode for executables Signed-off-by: Scott Rigby <scott@r6by.com>

Update pkg/getter/ocigetter to work for both charts and plugins, and …

e623fd1

…update plugin OCI installer accordingly Signed-off-by: Scott Rigby <scott@r6by.com>

Merge pull request #2 from scottrigby/plugin-oci-installer

055974c

OCI plugin installer

Plugin runtime support (#15)

a7c2460

Fix linting issues (#18)

782f25c

Extism/v1 plugin runtime support (#17)

54258b0

Fix legacy metadata downloader convert

a5f3b2d

lint

17ef923

Merge pull request #19 from gjenkins8/gjenkins/plugin-system/fix_lega…

97ed93d

…cy_downloader_convert Fix legacy metadata downloader convert

Merge branch 'plugin-system' into plugin-signing

9bb742d

Signed-off-by: Scott Rigby <scott@r6by.com>

Fix plugin signing after merge

3ecf343

Signed-off-by: Scott Rigby <scott@r6by.com>

Style fixes

b8ed27f

Signed-off-by: Scott Rigby <scott@r6by.com>

scottrigby force-pushed the plugin-signing branch from 4c3a918 to b8ed27f Compare August 13, 2025 07:47

scottrigby changed the base branch from plugin-types to plugin-system August 13, 2025 07:48

Support provenance for Plugin oci artifacts

b42984e

Signed-off-by: Scott Rigby <scott@r6by.com>

gjenkins8 reviewed Aug 13, 2025

View reviewed changes

gjenkins8 force-pushed the plugin-system branch from 584f7c5 to dd338a8 Compare August 16, 2025 20:25

scottrigby force-pushed the plugin-system branch from dd338a8 to 9ea7867 Compare August 16, 2025 22:48

gjenkins8 force-pushed the plugin-system branch from a0c50a4 to bbd1bca Compare August 17, 2025 05:54

scottrigby closed this Aug 30, 2025

Navigation Menu

Plugin signing and verifying - #6

Plugin signing and verifying#6
scottrigby wants to merge 78 commits into
plugin-systemfrom
plugin-signing

scottrigby commented Jul 25, 2025 •

edited

Loading

Uh oh!

gjenkins8 Aug 13, 2025

Uh oh!

scottrigby Aug 13, 2025

Uh oh!

gjenkins8 Aug 13, 2025

Uh oh!

scottrigby Aug 13, 2025

Uh oh!

scottrigby commented Aug 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

scottrigby commented Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gjenkins8 Aug 13, 2025

Choose a reason for hiding this comment

Uh oh!

scottrigby Aug 13, 2025

Choose a reason for hiding this comment

Uh oh!

gjenkins8 Aug 13, 2025

Choose a reason for hiding this comment

Uh oh!

scottrigby Aug 13, 2025

Choose a reason for hiding this comment

Uh oh!

scottrigby commented Aug 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

scottrigby commented Jul 25, 2025 •

edited

Loading