Provenance file for zot Helm package

[c92s]

Hello everyone,
I would like to use Helm to install zot on my system. Helm allows the use of a provenance file, which can be used to verify the origin and integrity of a Helm .tgz file. Do you think it would be possible to add automatic signing to the build CI and push the .prov file with it?

Ideally, I would like to use it as such:

helm pull --prov zot --repo https://zotregistry.dev/helm-charts

Which will currently print a warning:

WARNING: Verification not found for https://github.com/project-zot/helm-charts/releases/download/zot-0.1.97/zot-0.1.97.tgz: failed to fetch https://github.com/project-zot/helm-charts/releases/download/zot-0.1.97/zot-0.1.97.tgz.prov : 404 Not Found

BR and thanks for the work!

[andaaron]

@c92s thank you for reaching out, we'll look into this.

[andaaron]

The package is now signed https://artifacthub.io/packages/helm/zot/zot
See also https://github.com/project-zot/helm-charts/blob/main/PROVENANCE.md

[c92s]

Awesome, thanks for the quick implementation! :)