harbor

Chart · Datastore · standard · v0.0.13

digest pinnedcosign signedSPDX SBOMSLSA provenanceamd64 · arm64

Hardened harbor image, built from source on Wolfi.

Version

0.0.13 · latest 0.0.12 0.0.10 0.0.11 0.0.9 0.0.8 0.0.7 0.0.6 0.0.5 0.0.4 0.0.3 0.0.2 0.0.1

The latest line lives at the base page; older lines have their own page so you can pin and verify exactly that version.

Deployed image digest

sha256:c806fab759c58469ea44f24ee54e422d35f1bd4f780dab49d16586c5a2063040

Chart OCI version

oci://ghcr.io/quenchworks/charts/harbor:0.0.13

The chart pins its image by this signed digest, so you never track it yourself. Signatures, SBOM, and provenance attach to the same digest.

Signed

cosign keyless

SBOM

SPDX, on image

Provenance

SLSA build

Architectures

amd64, arm64

Runs as

nonroot (uid 1001)

Root filesystem

read-only

Install the chart

Deploy to Kubernetes with hardened defaults. The chart pins its image by signed digest, so you never track it yourself.

Install (latest)

helm install my-harbor oci://ghcr.io/quenchworks/charts/harbor --version 0.0.13

Deploys image (digest-pinned)

ghcr.io/quenchworks/images/harbor-core@sha256:c806fab759c58469ea44f24ee54e422d35f1bd4f780dab49d16586c5a2063040
ghcr.io/quenchworks/images/harbor-jobservice@sha256:b5e6a85c526d410d6ae18e0024e74b132844ecbbd7447f6df8888ae4004cac5d
ghcr.io/quenchworks/images/harbor-registry@sha256:53db54b5aa2e74cef404f389c79895ba11ae81733df875783198de47d3a50f21
ghcr.io/quenchworks/images/harbor-registryctl@sha256:05a93b6837f9d66c9e60ab953bf8f7785602114db8c1fe9dbad29c944416b2d9
ghcr.io/quenchworks/images/harbor-portal@sha256:85809ac40b4f954149daa33a5abde6c62109e199dbe99afbf07a48d7e4bb41ba
ghcr.io/quenchworks/images/harbor-trivy-adapter@sha256:c60421a4a95a097c4dce82e36dd6978e56f82b065ee22e834277ac864816c6c8
ghcr.io/quenchworks/images/harbor-exporter@sha256:d7467b826dd8190c346c81542d0e6dd19559abe0615b6ca25819b9f0c51a8972
ghcr.io/quenchworks/images/nginx@sha256:b2c2dda9d5762212b53079e2223e6055ea689bebdd0b3926220c86d772add903
ghcr.io/quenchworks/images/busybox@sha256:379b162cd4794ee14c63fec0cc501b855b804f33f824c4e46ced6183f644adfe
ghcr.io/quenchworks/images/postgresql@sha256:b492e8f2aa8528a0af8bc1aa835522ab222aa8e0a0a6c135b2d5fdc3e9467bd4
ghcr.io/quenchworks/images/valkey@sha256:4482926665b4e9fbe73b6ab15e403e1f4d9285112aca313ce4994095346c6565

Chart version: 0.0.13
App version: 2.15.2
Chart license: Apache-2.0
App license: Unknown
Signed: cosign (keyless)
Values schema: yes
Last published: 2026-07-15

Verify the chart

cosign verify ghcr.io/quenchworks/charts/harbor:0.0.13 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Transparency

The chart publishes its attestations on GitHub and the image it deploys carries its own on the same digest, publicly verifiable with the commands above. Both log to the Sigstore transparency log (Rekor), which cosign verify checks for you.

View on ArtifactHub Chart source

Upstream project: https://quench-works.com