{"record":{"id":"0cf926b868096000","repo":"helm/helm","slug":"verify-is-only-supported-for-plugin-tarballs-t","errorCode":null,"errorMessage":"--verify is only supported for plugin tarballs (.tgz files)","messagePattern":"--verify is only supported for plugin tarballs \\(\\.tgz files\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/plugin/installer/installer.go","lineNumber":90,"sourceCode":"}\n\n// InstallWithOptions installs a plugin with options.\nfunc InstallWithOptions(i Installer, opts Options) (*VerificationResult, error) {\n\tif err := os.MkdirAll(filepath.Dir(i.Path()), 0o755); err != nil {\n\t\treturn nil, err\n\t}\n\tif _, pathErr := os.Stat(i.Path()); !os.IsNotExist(pathErr) {\n\t\tslog.Warn(\"plugin already exists\", slog.String(\"path\", i.Path()), slog.Any(\"error\", pathErr))\n\t\treturn nil, errors.New(\"plugin already exists\")\n\t}\n\n\tvar result *VerificationResult\n\n\t// If verification is requested, check if installer supports it\n\tif opts.Verify {\n\t\tverifier, ok := i.(Verifier)\n\t\tif !ok || !verifier.SupportsVerification() {\n\t\t\treturn nil, errors.New(\"--verify is only supported for plugin tarballs (.tgz files)\")\n\t\t}\n\n\t\t// Get verification data (works for both memory and file-based installers)\n\t\tarchiveData, provData, filename, err := verifier.GetVerificationData()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to get verification data: %w\", err)\n\t\t}\n\n\t\t// Check if provenance data exists\n\t\tif len(provData) == 0 {\n\t\t\treturn nil, errors.New(\"plugin verification failed: no provenance file (.prov) found\")\n\t\t}\n\n\t\t// Provenance data exists - verify the plugin\n\t\tverification, err := plugin.VerifyPlugin(archiveData, provData, filename, opts.Keyring)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"plugin verification failed: %w\", err)\n\t\t}","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/helm/helm/blob/2a29f1770b62844b27197d2507377361d45ad7c0/internal/plugin/installer/installer.go#L72-L108","documentation":"InstallWithOptions with Options{Verify: true} (internal/plugin/installer/installer.go:90) type-asserts the installer to the Verifier interface and requires SupportsVerification(). Only local tarballs, HTTP .tgz/.tar.gz URLs, and OCI plugins implement Verifier - local directories and git/VCS sources have no signature to verify, so the request is rejected up front.","triggerScenarios":"'helm plugin install --verify ./myplugin-dir' (directory source), 'helm plugin install --verify https://github.com/org/repo' (VCS source), or Go code calling InstallWithOptions(i, Options{Verify: true}) with a VCSInstaller / non-archive LocalInstaller.","commonSituations":"Developers adding --verify to an existing directory or git-based plugin install; CI hardening that turns on --verify globally; assuming all install sources support provenance like chart repositories do.","solutions":["Package the plugin as a .tgz (with a .prov provenance file) and install from the tarball with --verify","Drop --verify for directory/git sources and establish trust another way (pinned ref, checksum comparison)","In Go, check the Verifier assertion yourself before setting Options.Verify"],"exampleFix":"# before\nhelm plugin install --verify ./myplugin-dir\n\n# after\ntar -czf myplugin-1.0.0.tgz myplugin/\nhelm plugin install --verify ./myplugin-1.0.0.tgz --keyring pubring.gpg","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"func verifySupported(i installer.Installer) bool {\n\tv, ok := i.(installer.Verifier)\n\treturn ok && v.SupportsVerification()\n}\n\n// only set Options{Verify: true} when verifySupported(i) is true","tryCatchPattern":"if _, err := installer.InstallWithOptions(i, installer.Options{Verify: true}); err != nil {\n\tif strings.Contains(err.Error(), \"--verify is only supported for plugin tarballs\") {\n\t\t// switch to a .tgz source or drop Verify from the options\n\t}\n}","preventionTips":["Restrict --verify workflows to tarball (local/HTTP) and OCI plugin sources","Package plugins as versioned .tgz + .prov if verification is part of your supply chain","In Go, assert the Verifier interface before setting Options.Verify"],"tags":["plugin","verification","cli","signature"],"backgroundTag":null,"analyzedSha":"2a29f1770b62844b27197d2507377361d45ad7c0","analyzedAt":"2026-08-15T22:02:47.490Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}