Helm Charts and OCI Artifacts

Your vendor may publish Helm charts alongside container images, and may sign images and attach SBOMs. You use your Breakwater credentials with all of it, and your license decides what you can access.

Examples use registry.breakwaterapp.com, with the username and secret from your license page.

Helm

echo "<secret>" | helm registry login registry.breakwaterapp.com -u <username> --password-stdin
helm pull oci://registry.breakwaterapp.com/vendor-name/chart-name --version 1.2.0
helm install my-release oci://registry.breakwaterapp.com/vendor-name/chart-name --version 1.2.0

Version ranges work, and resolve only among the versions your license allows:

helm pull oci://registry.breakwaterapp.com/vendor-name/chart-name --version ">=1.0.0 <2.0.0"

Verifying Signatures

cosign

docker login registry.breakwaterapp.com -u <username>
cosign verify --key vendor-cosign.pub registry.breakwaterapp.com/vendor-name/product-name@sha256:<digest>

If your vendor signs in cosign's OCI 1.1 mode, set COSIGN_EXPERIMENTAL=1 and add --experimental-oci11. To check an attached SBOM attestation:

cosign verify-attestation --key vendor-cosign.pub --type spdxjson \
  registry.breakwaterapp.com/vendor-name/product-name@sha256:<digest>

Your vendor provides the public key. Verify by digest, not by tag.

Notation

notation login registry.breakwaterapp.com -u <username>
notation verify registry.breakwaterapp.com/vendor-name/product-name@sha256:<digest>

This needs a Notation trust policy that trusts your vendor's certificate.

Finding and Downloading SBOMs

oras login registry.breakwaterapp.com -u <username>
oras discover registry.breakwaterapp.com/vendor-name/product-name@sha256:<digest>
oras pull registry.breakwaterapp.com/vendor-name/product-name@sha256:<sbom-digest>

oras discover lists what is attached to an image, including its signatures and SBOMs; oras pull downloads one by its digest.

Admission Controllers

Tools that verify signatures when pods start (Kyverno, Sigstore policy-controller, Ratify, and similar) fetch signatures from the registry, so they need credentials. Give them your customer token as an image pull secret:

kubectl create secret docker-registry breakwater-registry \
  --docker-server=registry.breakwaterapp.com \
  --docker-username=<username> \
  --docker-password=<secret>

License Restrictions

Signatures and SBOMs follow the image or chart they describe. If your license lets you pull a version, you can verify it and fetch its SBOM; for versions outside your license, both are denied along with the image.

Troubleshooting

Verification can't find a signature
- Check that you're verifying by digest and that the digest is the one your vendor signed
- Ask your vendor which signing mode and key they use (cosign classic, cosign OCI 1.1, or Notation)

403 or denied on a signature or SBOM
- The image it's attached to is outside your license's allowed versions