From 5a30c7ae8504218fd68d87c5a7d929d0a3bb3891 Mon Sep 17 00:00:00 2001
From: Solomon Wakhungu <65043605+1solomonwakhungu@users.noreply.github.com>
Date: Sun, 12 Jul 2026 23:00:17 -0500
Subject: [PATCH 1/3] fix(scripts): add cache-busting to get-helm-3 version
 check

The get-helm-3 script queries get.helm.sh/helm3-latest-version to
determine the latest release. The CDN serving this file has no
Cache-Control header, so edge servers can serve stale cached
responses for hours after a new release.

This causes non-deterministic behavior: machines running get-helm-3
at the same time can install different versions depending on which
CDN edge node they hit.

Fix: Append a timestamp query string (?ts=1783837438) to bust CDN
caches, and add Cache-Control: no-cache header to both curl and wget
requests.

Fixes #32329

Signed-off-by: Solomon Wakhungu <65043605+1solomonwakhungu@users.noreply.github.com>
---
 scripts/get-helm-3 | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/scripts/get-helm-3 b/scripts/get-helm-3
index 5f265a52f..dad66ab20 100755
--- a/scripts/get-helm-3
+++ b/scripts/get-helm-3
@@ -114,12 +114,14 @@ verifySupported() {
 checkDesiredVersion() {
   if [ "x$DESIRED_VERSION" == "x" ]; then
     # Get tag from release URL
-    local latest_release_url="https://get.helm.sh/helm3-latest-version"
+    # Append a cache-busting query string to avoid CDN edge servers
+    # serving stale version files after a new release.
+    local latest_release_url="https://get.helm.sh/helm3-latest-version?ts=$(date +%s)"
     local latest_release_response=""
     if [ "${HAS_CURL}" == "true" ]; then
-      latest_release_response=$( curl -L --silent --show-error --fail "$latest_release_url" 2>&1 || true )
+      latest_release_response=$( curl -L --silent --show-error --fail -H "Cache-Control: no-cache" "$latest_release_url" 2>&1 || true )
     elif [ "${HAS_WGET}" == "true" ]; then
-      latest_release_response=$( wget "$latest_release_url" -q -O - 2>&1 || true )
+      latest_release_response=$( wget "$latest_release_url" --header="Cache-Control: no-cache" -q -O - 2>&1 || true )
     fi
     TAG=$( echo "$latest_release_response" | grep '^v[0-9]' )
     if [ "x$TAG" == "x" ]; then

From bbaf420a101379dad4f8452129cf26f2fff7e536 Mon Sep 17 00:00:00 2001
From: Solomon Wakhungu <65043605+1solomonwakhungu@users.noreply.github.com>
Date: Mon, 27 Jul 2026 10:42:43 -0500
Subject: [PATCH 2/3] fix(scripts): address cache-busting review feedback

Signed-off-by: Solomon Wakhungu <65043605+1solomonwakhungu@users.noreply.github.com>
---
 scripts/get-helm-3 | 4 ++--
 scripts/get-helm-4 | 8 +++++---
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/scripts/get-helm-3 b/scripts/get-helm-3
index dad66ab20..117ae3e03 100755
--- a/scripts/get-helm-3
+++ b/scripts/get-helm-3
@@ -114,8 +114,8 @@ verifySupported() {
 checkDesiredVersion() {
   if [ "x$DESIRED_VERSION" == "x" ]; then
     # Get tag from release URL
-    # Append a cache-busting query string to avoid CDN edge servers
-    # serving stale version files after a new release.
+    # The current CDN does not revalidate on the request no-cache directive,
+    # so use a unique query while retaining no-cache for compliant intermediaries.
     local latest_release_url="https://get.helm.sh/helm3-latest-version?ts=$(date +%s)"
     local latest_release_response=""
     if [ "${HAS_CURL}" == "true" ]; then
diff --git a/scripts/get-helm-4 b/scripts/get-helm-4
index 1c90bbad5..0ff312a7f 100644
--- a/scripts/get-helm-4
+++ b/scripts/get-helm-4
@@ -114,12 +114,14 @@ verifySupported() {
 checkDesiredVersion() {
   if [ "x$DESIRED_VERSION" == "x" ]; then
     # Get tag from release URL
-    local latest_release_url="https://get.helm.sh/helm4-latest-version"
+    # The current CDN does not revalidate on the request no-cache directive,
+    # so use a unique query while retaining no-cache for compliant intermediaries.
+    local latest_release_url="https://get.helm.sh/helm4-latest-version?ts=$(date +%s)"
     local latest_release_response=""
     if [ "${HAS_CURL}" == "true" ]; then
-      latest_release_response=$( curl -L --silent --show-error --fail "$latest_release_url" 2>&1 || true )
+      latest_release_response=$( curl -L --silent --show-error --fail -H "Cache-Control: no-cache" "$latest_release_url" 2>&1 || true )
     elif [ "${HAS_WGET}" == "true" ]; then
-      latest_release_response=$( wget "$latest_release_url" -q -O - 2>&1 || true )
+      latest_release_response=$( wget "$latest_release_url" --header="Cache-Control: no-cache" -q -O - 2>&1 || true )
     fi
     TAG=$( echo "$latest_release_response" | grep '^v[0-9]' )
     if [ "x$TAG" == "x" ]; then

From bc0114c70841e2a05c95e53e20358fb761dbfb2e Mon Sep 17 00:00:00 2001
From: Solomon Wakhungu <65043605+1solomonwakhungu@users.noreply.github.com>
Date: Mon, 27 Jul 2026 13:55:05 -0500
Subject: [PATCH 3/3] fix(scripts): clarify cache-busting behavior

Signed-off-by: Solomon Wakhungu <65043605+1solomonwakhungu@users.noreply.github.com>
---
 scripts/get-helm-3 | 3 ++-
 scripts/get-helm-4 | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/scripts/get-helm-3 b/scripts/get-helm-3
index 117ae3e03..a73b3da2a 100755
--- a/scripts/get-helm-3
+++ b/scripts/get-helm-3
@@ -114,12 +114,13 @@ verifySupported() {
 checkDesiredVersion() {
   if [ "x$DESIRED_VERSION" == "x" ]; then
     # Get tag from release URL
+    # Cache behavior is provider-specific, so this mitigation is best effort.
     # The current CDN does not revalidate on the request no-cache directive,
     # so use a unique query while retaining no-cache for compliant intermediaries.
     local latest_release_url="https://get.helm.sh/helm3-latest-version?ts=$(date +%s)"
     local latest_release_response=""
     if [ "${HAS_CURL}" == "true" ]; then
-      latest_release_response=$( curl -L --silent --show-error --fail -H "Cache-Control: no-cache" "$latest_release_url" 2>&1 || true )
+      latest_release_response=$( curl -L --silent --show-error --fail --header "Cache-Control: no-cache" "$latest_release_url" 2>&1 || true )
     elif [ "${HAS_WGET}" == "true" ]; then
       latest_release_response=$( wget "$latest_release_url" --header="Cache-Control: no-cache" -q -O - 2>&1 || true )
     fi
diff --git a/scripts/get-helm-4 b/scripts/get-helm-4
index 0ff312a7f..3d232cca9 100644
--- a/scripts/get-helm-4
+++ b/scripts/get-helm-4
@@ -114,12 +114,13 @@ verifySupported() {
 checkDesiredVersion() {
   if [ "x$DESIRED_VERSION" == "x" ]; then
     # Get tag from release URL
+    # Cache behavior is provider-specific, so this mitigation is best effort.
     # The current CDN does not revalidate on the request no-cache directive,
     # so use a unique query while retaining no-cache for compliant intermediaries.
     local latest_release_url="https://get.helm.sh/helm4-latest-version?ts=$(date +%s)"
     local latest_release_response=""
     if [ "${HAS_CURL}" == "true" ]; then
-      latest_release_response=$( curl -L --silent --show-error --fail -H "Cache-Control: no-cache" "$latest_release_url" 2>&1 || true )
+      latest_release_response=$( curl -L --silent --show-error --fail --header "Cache-Control: no-cache" "$latest_release_url" 2>&1 || true )
     elif [ "${HAS_WGET}" == "true" ]; then
       latest_release_response=$( wget "$latest_release_url" --header="Cache-Control: no-cache" -q -O - 2>&1 || true )
     fi