Helmwart

Trust

Know what leaves your machine.

Start with the data boundaries. Helmwart scans supported configurations locally. Account services, guidance downloads, and optional report sharing have separate network behavior.

See the data boundaries Verify a release

Planning a team evaluation? See how a guided review works.

A configuration scan, at a glance

On your machine

  1. Supported configuration
  2. Local analysis
  3. Findings and release-gate result

Raw repository contents stay local during a normal scan.

Separate network operations

Account & guidanceAuthentication and content downloads
Report sharingDerived reports when you request an upload

Data boundaries

Local analysis. Explicit sharing choices.

Configuration scanning runs locally. Helmwart reads supported configuration files and computes findings and the release-gate result on your machine. It does not upload the raw repository during a normal scan.

helmwart login
Opens browser authentication and saves a local session. Authentication sends normal connection metadata plus the CLI operating system and hostname.
helmwart content update
Downloads licensed remediation guidance from /api/content/v1. It does not send your configuration.
--record and --open
Upload a derived report to /api/scans/record. Reports contain findings and component or Skills metadata, not raw configuration or file contents. Review names before sharing.
--explain-ai
Sends the selected finding to Helmwart’s explanation endpoint. Cloud and tracker commands make their own authenticated requests.
Installation and updates
npm contacts the registry to install packages. There is no automatic CLI update check in the launcher or command entry point.

In a guided review, observation is manual and consent-based; recording a scan is optional. See the review process.

Release evidence

Check the package before you run it.

Official tagged releases use the evidence below. Older releases may lack it, and a local development build is not an official release.

SHA-256
Detects whether the binary differs from the signed manifest. A checksum by itself does not identify the publisher.
Sigstore
Checks the artifact against Helmwart’s tagged GitHub Actions workflow and issuer. It is not a SLSA provenance claim and not a signature over the entire npm archive or launcher JavaScript.
CycloneDX 1.6 SBOM
Lists bundled modules. The canonical file is packages/cli/dist/helmwart.cdx.json; packages contain sbom.cdx.json and manifest.json.
Platform signing
Official macOS binaries must be Apple Developer ID signed and notarized. Windows is not Authenticode signed; Windows and Linux rely on Sigstore and checksums.

Verification authenticates release artifacts; it does not guarantee complete threat discovery or prove that dependencies are safe. Helmwart is not a certification, audit, or legal opinion.

Verification instructions

Choose your platform.

Install cosign v3.0.6, npm, and tar. The release workflow currently pins cosign v3.0.6; older cosign 2.x cannot read these release bundles. Linux and macOS also use Node.js to compare the binary with its signed manifest. Replace REPLACE_WITH_RELEASE_VERSION with the exact npm version. These commands download the package with install scripts disabled; they do not run Helmwart.

Use linux-arm64 instead of linux-x64 for Linux arm64, or darwin-x64 instead of darwin-arm64 for Intel macOS.

Linux x64 · Bash
Exact workflow and artifact verification
(
set -eu
VERSION='REPLACE_WITH_RELEASE_VERSION'
IDENTITY="https://github.com/KodyMike/helmwart/.github/workflows/release-cli.yml@refs/tags/cli-v$VERSION"
ISSUER='https://token.actions.githubusercontent.com'
VERIFY_DIR=$(mktemp -d)
trap 'rm -rf "$VERIFY_DIR"' EXIT
cd "$VERIFY_DIR"
npm pack "@helmwart/cli-linux-x64@$VERSION" --ignore-scripts
tar -xzf "helmwart-cli-linux-x64-$VERSION.tgz"
cd package
verify_blob() {
  cosign verify-blob \
    --bundle "$1" \
    --certificate-identity "$IDENTITY" \
    --certificate-oidc-issuer "$ISSUER" \
    "$2"
}
verify_blob manifest.json.sigstore.json manifest.json
verify_blob sbom.cdx.json.sigstore.json sbom.cdx.json
verify_blob bin/helmwart-linux-x64.sigstore.json bin/helmwart-linux-x64
verify_blob bin/helmwart-linux-x64.sha256.sigstore.json bin/helmwart-linux-x64.sha256
(cd bin && sha256sum -c helmwart-linux-x64.sha256)
node <<'NODE'
const fs = require('node:fs');
const crypto = require('node:crypto');
const manifest = JSON.parse(fs.readFileSync('manifest.json', 'utf8'));
const binary = manifest.binaries.find(entry => entry.platform === 'linux-x64');
const actual = crypto.createHash('sha256').update(fs.readFileSync('bin/helmwart-linux-x64')).digest('hex');
if (!binary || binary.sha256 !== actual) throw new Error('Manifest SHA-256 does not match the Linux binary');
console.log('Signed manifest SHA-256 matches the Linux binary');
NODE
)
macOS Apple Silicon · Bash or zsh
Exact workflow and artifact verification
(
set -eu
VERSION='REPLACE_WITH_RELEASE_VERSION'
IDENTITY="https://github.com/KodyMike/helmwart/.github/workflows/release-cli.yml@refs/tags/cli-v$VERSION"
ISSUER='https://token.actions.githubusercontent.com'
VERIFY_DIR=$(mktemp -d)
trap 'rm -rf "$VERIFY_DIR"' EXIT
cd "$VERIFY_DIR"
npm pack "@helmwart/cli-darwin-arm64@$VERSION" --ignore-scripts
tar -xzf "helmwart-cli-darwin-arm64-$VERSION.tgz"
cd package
verify_blob() {
  cosign verify-blob \
    --bundle "$1" \
    --certificate-identity "$IDENTITY" \
    --certificate-oidc-issuer "$ISSUER" \
    "$2"
}
verify_blob manifest.json.sigstore.json manifest.json
verify_blob sbom.cdx.json.sigstore.json sbom.cdx.json
verify_blob bin/helmwart-darwin-arm64.sigstore.json bin/helmwart-darwin-arm64
verify_blob bin/helmwart-darwin-arm64.sha256.sigstore.json bin/helmwart-darwin-arm64.sha256
(cd bin && shasum -a 256 -c helmwart-darwin-arm64.sha256)
codesign --verify --strict --verbose=2 bin/helmwart-darwin-arm64
codesign -dv --verbose=4 bin/helmwart-darwin-arm64 2>&1 | grep -E 'Authority=Developer ID Application|TeamIdentifier='
node <<'NODE'
const fs = require('node:fs');
const crypto = require('node:crypto');
const manifest = JSON.parse(fs.readFileSync('manifest.json', 'utf8'));
const binary = manifest.binaries.find(entry => entry.platform === 'darwin-arm64');
const actual = crypto.createHash('sha256').update(fs.readFileSync('bin/helmwart-darwin-arm64')).digest('hex');
if (!binary || binary.sha256 !== actual || binary.signed !== true || binary.notarised !== true) {
  throw new Error('Signed manifest does not confirm this macOS binary, signature, and notarisation');
}
console.log('Signed manifest confirms the macOS binary, signature, and notarisation');
NODE
)
Windows x64 · PowerShell
Exact workflow and artifact verification
$Version = 'REPLACE_WITH_RELEASE_VERSION'
$Identity = "https://github.com/KodyMike/helmwart/.github/workflows/release-cli.yml@refs/tags/cli-v$Version"
$Issuer = 'https://token.actions.githubusercontent.com'
$ErrorActionPreference = 'Stop'
$VerifyDir = Join-Path ([System.IO.Path]::GetTempPath()) ([guid]::NewGuid().ToString())
New-Item -ItemType Directory -Path $VerifyDir | Out-Null
try {
Set-Location $VerifyDir
npm pack "@helmwart/cli-win32-x64@$Version" --ignore-scripts
if ($LASTEXITCODE -ne 0) { throw 'npm pack failed' }
tar -xzf "helmwart-cli-win32-x64-$Version.tgz"
if ($LASTEXITCODE -ne 0) { throw 'Extraction failed' }
Set-Location package
function Test-BlobSignature {
  param([string]$File, [string]$Bundle, [string]$Label)
  cosign verify-blob --bundle $Bundle --certificate-identity $Identity --certificate-oidc-issuer $Issuer $File
  if ($LASTEXITCODE -ne 0) { throw "$Label signature verification failed" }
}
Test-BlobSignature manifest.json.sigstore.json manifest.json 'Manifest'
Test-BlobSignature sbom.cdx.json.sigstore.json sbom.cdx.json 'SBOM'
Test-BlobSignature bin/helmwart-win32-x64.exe.sigstore.json bin/helmwart-win32-x64.exe 'Binary'
Test-BlobSignature bin/helmwart-win32-x64.exe.sha256.sigstore.json bin/helmwart-win32-x64.exe.sha256 'Checksum'
$Manifest = Get-Content manifest.json -Raw | ConvertFrom-Json
$Binary = $Manifest.binaries | Where-Object { $_.platform -eq 'win32-x64' }
$Expected = ((Get-Content bin/helmwart-win32-x64.exe.sha256 -Raw).Trim() -split '\s+')[0]
$Actual = (Get-FileHash bin/helmwart-win32-x64.exe -Algorithm SHA256).Hash
if (-not $Binary -or $Expected -ine $Binary.sha256 -or $Actual -ine $Binary.sha256) { throw 'SHA-256 does not match the signed manifest' }
'Signed manifest SHA-256 matches the Windows binary'
} finally {
  Set-Location ([System.IO.Path]::GetTempPath())
  Remove-Item -LiteralPath $VerifyDir -Recurse -Force -ErrorAction SilentlyContinue
}

Every signature and checksum must pass. Stop if a bundle is missing, the workflow identity differs, or any command exits with an error. The commands also compare the binary SHA-256 with the verified manifest. On macOS, they check the local Developer ID signature and require the signed manifest to mark that binary as signed and notarized. Confirm the manifest version and commit are the release you intended to verify.

Distribution and reporting

Helmwart is a proprietary, free-to-use CLI. The engine source remains private, and work commands require a signed-in account. See the distributed license, terms, and privacy policy.

npm launcher · latest packaged SBOM · latest packaged manifest · privacy policy · security contact

The “latest” links are convenient references. Use an explicit package version above when you need a reproducible verification.