external-secrets

Verify this Helm chart using Cosign to confirm it was published by Minimus and was not modified post-publication. Cosign by Sigstore is the recommended open source toolset for supply-chain security.

Get Cosign

You can use the Cosign image offered by Minimus or install the following locally:

Cosign-a command line utility used to sign software artifacts and verify and download image signatures and attestations.
jq-a JSON processor used to format the signatures and attestations.

Verify Chart Signature

Run the Cosign command to verify the Helm chart signature and confirm its integrity.

Verify this chart version

cosign verify "helm.mini.dev/external-secrets@sha256:62df419bb1ae017b3e284ba0b5aaa736f226d1f57bd35f665c6194a2b73d9dd5" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --certificate-identity-regexp "https://github.com/minimusio/helm-charts/.github/workflows/.*\\.ya?ml@refs/.*"

Minimus uses Cosign keyless signing with Sigstore and GitHub Actions OIDC.

Expected output

Verification for helm.mini.dev/external-secrets@sha256:62df419bb1ae017b3e284ba0b5aaa736f226d1f57bd35f665c6194a2b73d9dd5 --
The following checks were performed on each of these signatures:
- The cosign claims were validated
- Existence of the claims in the transparency log was verified offline
- The code-signing certificate was verified using trusted certificate authority certificates
[ { ...signature claims JSON... } ]