Helm 4 installation with verification fails due to missing SHA in provenance file

### Current Behavior I was following the installation description in https://github.com/jkroepke/helm-secrets/wiki/Installation#helm-4 to install Helm Secrets in my Dockerfile. After getting through the process of setting up `gpg` with your signing key, and exporting the `gpg` database to the right location for Helm to pick it up, I get the following error from the Helm plugin command: ``` > [ 8/12] RUN helm plugin install https://github.com/jkroepke/helm-secrets/releases/download/v4.7.0/helm-secrets.tgz: 0.168 Verifying plugin signature... 0.227 Error: plugin verification failed: provenance does not contain a SHA for a file named "helm-secrets.tgz" ``` I checked the provenance file, and it indeed has only a SHA for the file inside this `.tgz` called `secrets-4.7.0.tgz`: ```yaml files: secrets-4.7.0.tgz: sha256:e2620b86f6f03cc13d6657b68c3c2552fcb649e5f2b7c105766b56f043dd0ef2 ``` It seems that Helm expects there to be a SHA for the whole `helm-secrets.tgz` file as well. ### Expected Behavior I would expect the provenance file to work if I run helm plugin install https://github.com/jkroepke/helm-secrets/releases/download/v4.7.0/helm-secrets.tgz . ### Steps To Reproduce This is the Dockerfile I am trying to build: ```dockerfile FROM bitnami/minideb:latest@sha256:bde17110f4074ea9ef0552e751be2d49111dd529eaea72bccd7490a11e042d56 ARG ARCH=amd64 ARG VALS_VERSION=0.42.5 ARG HELM_SECRETS_VERSION=4.7.* RUN install_packages bash ca-certificates curl git jq openssl gnupg2 # Install Helm RUN curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-4 | bash # Install Helm Secrets RUN curl https://github.com/jkroepke.gpg | gpg --import RUN mkdir -p /root/.gnupg && gpg --export >~/.gnupg/pubring.gpg RUN helm plugin install https://github.com/jkroepke/helm-secrets/releases/download/v4.7.0/helm-secrets.tgz RUN helm plugin install https://github.com/jkroepke/helm-secrets/releases/download/v4.7.0/helm-secrets-getter.tgz RUN helm plugin install https://github.com/jkroepke/helm-secrets/releases/download/v4.7.0/helm-secrets-post-renderer.tgz # Install Vals RUN mkdir vals && curl -L https://github.com/helmfile/vals/releases/download/v${VALS_VERSION}/vals_${VALS_VERSION}_linux_${ARCH}.tar.gz | tar -xz -C vals RUN mv vals/vals /usr/local/bin/vals ENV HELM_SECRETS_BACKEND=vals ``` ### Environment - Helm Version: 4.0.0 - Helm Secrets Version: 4.7.0 ### Anything else? Thanks for making and maintaining Helm Secrets ❤️