{"record":{"id":"7e3630281cabb3f9","repo":"helm/helm","slug":"plugin-verification-failed-no-provenance-file-p","errorCode":null,"errorMessage":"plugin verification failed: no provenance file (.prov) found","messagePattern":"plugin verification failed: no provenance file \\(\\.prov\\) found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/plugin/installer/installer.go","lineNumber":101,"sourceCode":"\n\tvar result *VerificationResult\n\n\t// If verification is requested, check if installer supports it\n\tif opts.Verify {\n\t\tverifier, ok := i.(Verifier)\n\t\tif !ok || !verifier.SupportsVerification() {\n\t\t\treturn nil, errors.New(\"--verify is only supported for plugin tarballs (.tgz files)\")\n\t\t}\n\n\t\t// Get verification data (works for both memory and file-based installers)\n\t\tarchiveData, provData, filename, err := verifier.GetVerificationData()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to get verification data: %w\", err)\n\t\t}\n\n\t\t// Check if provenance data exists\n\t\tif len(provData) == 0 {\n\t\t\treturn nil, errors.New(\"plugin verification failed: no provenance file (.prov) found\")\n\t\t}\n\n\t\t// Provenance data exists - verify the plugin\n\t\tverification, err := plugin.VerifyPlugin(archiveData, provData, filename, opts.Keyring)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"plugin verification failed: %w\", err)\n\t\t}\n\n\t\t// Collect verification info\n\t\tresult = &VerificationResult{\n\t\t\tSignedBy:    make([]string, 0),\n\t\t\tFingerprint: fmt.Sprintf(\"%X\", verification.SignedBy.PrimaryKey.Fingerprint),\n\t\t\tFileHash:    verification.FileHash,\n\t\t}\n\t\tfor name := range verification.SignedBy.Identities {\n\t\t\tresult.SignedBy = append(result.SignedBy, name)\n\t\t}\n\t}","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/helm/helm/blob/2a29f1770b62844b27197d2507377361d45ad7c0/internal/plugin/installer/installer.go#L83-L119","documentation":"During verified install (internal/plugin/installer/installer.go:101), after GetVerificationData() succeeds, empty provenance data yields this error before any cryptographic check runs. The .prov file is looked up as Source+\".prov\" (HTTP/OCI) or read from <tarball>.tgz.prov next to a local tarball; no provenance means nothing to verify the archive against.","triggerScenarios":"'helm plugin install --verify ./x.tgz' with no x.tgz.prov beside it; an HTTP URL where fetching source+'.prov' 404s (GetVerificationData silently returns nil provData); an OCI ref without a .prov companion artifact.","commonSituations":"Plugin authors who never generated/published provenance; download mirrors that only host the tarball; wrong keyring/prov file naming (the .prov must be named exactly like the tarball plus '.prov').","solutions":["Obtain the .prov file from the plugin author and place it next to the tarball (local) or publish it at URL+'.prov' / as an OCI companion","Generate provenance for your own plugin with 'helm plugin sign' style signing tooling before publishing","If trust is established otherwise (checksum from a trusted channel), install without --verify"],"exampleFix":"# before\nhelm plugin install --verify ./myplugin-1.0.0.tgz   # no .prov present\n\n# after\ncp ~/downloads/myplugin-1.0.0.tgz.prov .\nhelm plugin install --verify ./myplugin-1.0.0.tgz --keyring pubring.gpg","handlingStrategy":"validation","validationCode":"// local tarball: check the .prov companion before requesting verification\nif _, err := os.Stat(tarballPath + \".prov\"); errors.Is(err, fs.ErrNotExist) {\n\treturn errors.New(\"no .prov file next to tarball; --verify would fail\")\n}\n// remote: HEAD/GET the source+\".prov\" URL and require HTTP 200 before --verify","typeGuard":null,"tryCatchPattern":"if _, err := installer.InstallWithOptions(i, opts); err != nil {\n\tif strings.Contains(err.Error(), \"no provenance file (.prov) found\") {\n\t\t// fetch/publish the .prov, or install without --verify once trust is established\n\t}\n}","preventionTips":["Always publish <name>-<version>.tgz.prov next to the tarball when you sign plugins","Name the .prov exactly as the tarball filename plus '.prov'","Pre-check prov availability (local stat or HTTP status on URL+.prov) before scripting --verify installs"],"tags":["plugin","verification","provenance","signature"],"backgroundTag":null,"analyzedSha":"2a29f1770b62844b27197d2507377361d45ad7c0","analyzedAt":"2026-08-15T22:02:47.490Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}