--verify is only supported for plugin tarballs (.tgz files)

Error message

--verify is only supported for plugin tarballs (.tgz files)

What it means

InstallWithOptions with Options{Verify: true} (internal/plugin/installer/installer.go:90) type-asserts the installer to the Verifier interface and requires SupportsVerification(). Only local tarballs, HTTP .tgz/.tar.gz URLs, and OCI plugins implement Verifier - local directories and git/VCS sources have no signature to verify, so the request is rejected up front.

Source

Thrown at internal/plugin/installer/installer.go:90

}

// InstallWithOptions installs a plugin with options.
func InstallWithOptions(i Installer, opts Options) (*VerificationResult, error) {
	if err := os.MkdirAll(filepath.Dir(i.Path()), 0o755); err != nil {
		return nil, err
	}
	if _, pathErr := os.Stat(i.Path()); !os.IsNotExist(pathErr) {
		slog.Warn("plugin already exists", slog.String("path", i.Path()), slog.Any("error", pathErr))
		return nil, errors.New("plugin already exists")
	}

	var result *VerificationResult

	// If verification is requested, check if installer supports it
	if opts.Verify {
		verifier, ok := i.(Verifier)
		if !ok || !verifier.SupportsVerification() {
			return nil, errors.New("--verify is only supported for plugin tarballs (.tgz files)")
		}

		// Get verification data (works for both memory and file-based installers)
		archiveData, provData, filename, err := verifier.GetVerificationData()
		if err != nil {
			return nil, fmt.Errorf("failed to get verification data: %w", err)
		}

		// Check if provenance data exists
		if len(provData) == 0 {
			return nil, errors.New("plugin verification failed: no provenance file (.prov) found")
		}

		// Provenance data exists - verify the plugin
		verification, err := plugin.VerifyPlugin(archiveData, provData, filename, opts.Keyring)
		if err != nil {
			return nil, fmt.Errorf("plugin verification failed: %w", err)
		}

View on GitHub (pinned to 2a29f1770b)

Solutions

Package the plugin as a .tgz (with a .prov provenance file) and install from the tarball with --verify
Drop --verify for directory/git sources and establish trust another way (pinned ref, checksum comparison)
In Go, check the Verifier assertion yourself before setting Options.Verify

Example fix

# before
helm plugin install --verify ./myplugin-dir

# after
tar -czf myplugin-1.0.0.tgz myplugin/
helm plugin install --verify ./myplugin-1.0.0.tgz --keyring pubring.gpg

Defensive patterns

Strategy: type-guard

Type guard

func verifySupported(i installer.Installer) bool {
	v, ok := i.(installer.Verifier)
	return ok && v.SupportsVerification()
}

// only set Options{Verify: true} when verifySupported(i) is true

Try / catch

if _, err := installer.InstallWithOptions(i, installer.Options{Verify: true}); err != nil {
	if strings.Contains(err.Error(), "--verify is only supported for plugin tarballs") {
		// switch to a .tgz source or drop Verify from the options
	}
}

Prevention

Restrict --verify workflows to tarball (local/HTTP) and OCI plugin sources
Package plugins as versioned .tgz + .prov if verification is part of your supply chain
In Go, assert the Verifier interface before setting Options.Verify

When it happens

Trigger: 'helm plugin install --verify ./myplugin-dir' (directory source), 'helm plugin install --verify https://github.com/org/repo' (VCS source), or Go code calling InstallWithOptions(i, Options{Verify: true}) with a VCSInstaller / non-archive LocalInstaller.

Common situations: Developers adding --verify to an existing directory or git-based plugin install; CI hardening that turns on --verify globally; assuming all install sources support provenance like chart repositories do.

Related errors

AI-assisted analysis of helm/helm@2a29f1770b (2026-08-15). Data as JSON: /api/errors/0cf926b868096000. Report an issue: GitHub.