HelmController to verify .prov file

[nuriel77]

Is there a plan to add some kind of verification to charts?

See the functionality in Helm:

https://helm.sh/docs/topics/provenance/

Helm has provenance tools which help chart users verify the integrity and origin of a package. Using industry-standard tools based on PKI, GnuPG, and well-respected package managers, Helm can generate and verify signature files.

I'd basically keep the .prov (maybe in my own repository) and be able to verify that the chart being pulled in to the cluster is correct.

[hiddeco]

The verification is on my "must be added" list, but would be performed by the source-controller.

I am however currently focusing on landing fluxcd/source-controller#361 first, which deals with a fair amount of technical debt so that there is room for additional complexity (or features rather) again.