mirror of https://github.com/helm/helm
oras-go v2.6.1's descriptor-size security patch added a hard 32 MiB cap in
content.ReadAll, so pulling any OCI artifact with a layer over 32 MiB fails
with 'failed to perform "Push" on destination: invalid descriptor size'.
Helm's plugin install path copies the plugin tarball layer into an in-memory
store, so plugins like helm-unittest (~160 MiB layer) cannot be installed by
any released 4.2.x: v4.2.1 through v4.2.4 all pin v2.6.1.
oras-go v2.6.2 bounds only the initial buffer allocation instead of rejecting
on declared size, with VerifyReader still enforcing size and digest, so large
legitimate layers work again. main already carries this bump (84e63e5c3,
#32333); this applies the same dependency update to release-4.2.
Verified against the report in #32247: a binary built from this branch
installs oci://ghcr.io/helm-unittest/helm-unittest/unittest:1.1.1 successfully,
while the v4.2.4 binary fails; pkg/registry and internal/plugin tests pass.
Fixes #32247
Signed-off-by: Bisman-Singh <bismanmadaan1@gmail.com>
pull/32593/head
Bisman-Singh
1 month ago
parent
3900f434fd
commit
6308239c4b
Loading…
Reference in new issue