flux v2.9.5

HelmChart.spec.verify

Verify contains the secret name containing the trusted public keys used to verify the signature and specifies which provider to use to check whether OCI image is authentic. This field is only supported when using HelmRepository source with spec.type 'oci'. Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified.

HelmChart.spec.verify fields and descriptions
Field / Type	Description
matchOIDCIdentity `object[]`	MatchOIDCIdentity specifies the identity matching criteria to use while verifying an OCI artifact which was signed using Cosign keyless signing. The artifact's identity is deemed to be verified if any of the specified matchers match against the identity.
provider `string` required	Provider specifies the technology used to sign the OCI Artifact. `enum: ["cosign","notation"]` `default: "cosign"`
secretRef `object`	SecretRef specifies the Kubernetes Secret containing the trusted public keys.