helm/helm · error

--key is required for signing a package

Error message

--key is required for signing a package

What it means

'helm package --sign' creates a detached provenance (.prov) file that must record the signing identity. RunE validates that --key (the key id/userId used with GPG) was provided before any archive is written or GPG is invoked, and aborts with this error when it is empty.

Source

Thrown at pkg/cmd/package.go:69

	client := action.NewPackage()
	valueOpts := &values.Options{}

	cmd := &cobra.Command{
		Use:   "package [CHART_PATH] [...]",
		Short: "package a chart directory into a chart archive",
		Long:  packageDesc,
		RunE: func(_ *cobra.Command, args []string) error {
			if len(args) == 0 {
				return errors.New("need at least one argument, the path to the chart")
			}
			sourceDateEpoch, err := sourceDateEpochFromEnv()
			if err != nil {
				return err
			}
			client.SourceDateEpoch = sourceDateEpoch
			if client.Sign {
				if client.Key == "" {
					return errors.New("--key is required for signing a package")
				}
				if client.Keyring == "" {
					return errors.New("--keyring is required for signing a package")
				}
			}
			client.RepositoryConfig = settings.RepositoryConfig
			client.RepositoryCache = settings.RepositoryCache
			p := getter.All(settings)
			vals, err := valueOpts.MergeValues(p)
			if err != nil {
				return err
			}

			registryClient, err := newRegistryClient(out, client.CertFile, client.KeyFile, client.CaFile,
				client.InsecureSkipTLSVerify, client.PlainHTTP, client.Username, client.Password)
			if err != nil {
				return fmt.Errorf("missing registry client: %w", err)
			}

View on GitHub (pinned to 2a29f1770b)

Solutions

1. Add the signing identity: helm package --sign --key "your-gpg-key-id" ./chart
2. Verify the key exists and get its id: gpg --list-secret-keys
3. If signing was unintentional, drop --sign

Example fix

# before
helm package ./chart --sign --keyring ~/.gnupg/pubring.gpg

# after
helm package ./chart --sign --key "Jane Developer <jane@example.com>" --keyring ~/.gnupg/pubring.gpg

if sign {
	if keyID == "" {
		return fmt.Errorf("--key is required for signing; set SIGN_KEY or pass --key")
	}
}
// then invoke helm package --sign --key "$keyID"

When it happens

Trigger: helm package --sign ./chart with no --key flag (client.Key == ""), i.e. the signing switch was flipped but the identity was not supplied.

Common situations: CI jobs copying a signing example but deleting the key line, key id stored in a variable that is empty in the runner, local first-time signing.

Related errors

• --keyring is required for signing a package
• private key not found
• provided key is not a private key. Try providing a keyring w
• more than one key contain the id %q
• failed to write to clearsign encoder: %w

AI-assisted analysis of helm/helm@2a29f1770b (2026-08-15). Data as JSON: /api/errors/50aaa0a0bc2b9fa8. Report an issue: GitHub.