{"record":{"id":"50aaa0a0bc2b9fa8","repo":"helm/helm","slug":"key-is-required-for-signing-a-package","errorCode":null,"errorMessage":"--key is required for signing a package","messagePattern":"--key is required for signing a package","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cmd/package.go","lineNumber":69,"sourceCode":"\tclient := action.NewPackage()\n\tvalueOpts := &values.Options{}\n\n\tcmd := &cobra.Command{\n\t\tUse:   \"package [CHART_PATH] [...]\",\n\t\tShort: \"package a chart directory into a chart archive\",\n\t\tLong:  packageDesc,\n\t\tRunE: func(_ *cobra.Command, args []string) error {\n\t\t\tif len(args) == 0 {\n\t\t\t\treturn errors.New(\"need at least one argument, the path to the chart\")\n\t\t\t}\n\t\t\tsourceDateEpoch, err := sourceDateEpochFromEnv()\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tclient.SourceDateEpoch = sourceDateEpoch\n\t\t\tif client.Sign {\n\t\t\t\tif client.Key == \"\" {\n\t\t\t\t\treturn errors.New(\"--key is required for signing a package\")\n\t\t\t\t}\n\t\t\t\tif client.Keyring == \"\" {\n\t\t\t\t\treturn errors.New(\"--keyring is required for signing a package\")\n\t\t\t\t}\n\t\t\t}\n\t\t\tclient.RepositoryConfig = settings.RepositoryConfig\n\t\t\tclient.RepositoryCache = settings.RepositoryCache\n\t\t\tp := getter.All(settings)\n\t\t\tvals, err := valueOpts.MergeValues(p)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\tregistryClient, err := newRegistryClient(out, client.CertFile, client.KeyFile, client.CaFile,\n\t\t\t\tclient.InsecureSkipTLSVerify, client.PlainHTTP, client.Username, client.Password)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"missing registry client: %w\", err)\n\t\t\t}","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/helm/helm/blob/2a29f1770b62844b27197d2507377361d45ad7c0/pkg/cmd/package.go#L51-L87","documentation":"'helm package --sign' creates a detached provenance (.prov) file that must record the signing identity. RunE validates that --key (the key id/userId used with GPG) was provided before any archive is written or GPG is invoked, and aborts with this error when it is empty.","triggerScenarios":"helm package --sign ./chart with no --key flag (client.Key == \"\"), i.e. the signing switch was flipped but the identity was not supplied.","commonSituations":"CI jobs copying a signing example but deleting the key line, key id stored in a variable that is empty in the runner, local first-time signing.","solutions":["Add the signing identity: helm package --sign --key \"your-gpg-key-id\" ./chart","Verify the key exists and get its id: gpg --list-secret-keys","If signing was unintentional, drop --sign"],"exampleFix":"# before\nhelm package ./chart --sign --keyring ~/.gnupg/pubring.gpg\n\n# after\nhelm package ./chart --sign --key \"Jane Developer <jane@example.com>\" --keyring ~/.gnupg/pubring.gpg","handlingStrategy":"validation","validationCode":"if sign {\n\tif keyID == \"\" {\n\t\treturn fmt.Errorf(\"--key is required for signing; set SIGN_KEY or pass --key\")\n\t}\n}\n// then invoke helm package --sign --key \"$keyID\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Centralize signing flags in one make target or script","Store the key id in CI secrets and fail the job when unset","Confirm the id exists: gpg --list-secret-keys"],"tags":["signing","gpg","package","provenance"],"backgroundTag":null,"analyzedSha":"2a29f1770b62844b27197d2507377361d45ad7c0","analyzedAt":"2026-08-15T22:02:47.490Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}