From 9b34535a84a51e8b3660f613ace57d94538fe21c Mon Sep 17 00:00:00 2001
From: Evans Mungai <mbuevans@gmail.com>
Date: Wed, 3 Dec 2025 14:02:09 +0000
Subject: [PATCH] Add cmd test for OCI references with tag+digest

Signed-off-by: Evans Mungai <mbuevans@gmail.com>
---
 pkg/cmd/pull_test.go           | 48 ++++++++++++++++++++++++++++++++++
 pkg/repo/v1/repotest/server.go | 12 +++++----
 2 files changed, 55 insertions(+), 5 deletions(-)

diff --git a/pkg/cmd/pull_test.go b/pkg/cmd/pull_test.go
index 96631fe05..36efe7b7f 100644
--- a/pkg/cmd/pull_test.go
+++ b/pkg/cmd/pull_test.go
@@ -506,3 +506,51 @@ func TestPullFileCompletion(t *testing.T) {
 	checkFileCompletion(t, "pull", false)
 	checkFileCompletion(t, "pull repo/chart", false)
 }
+
+// TestPullOCIWithTagAndDigest tests pulling an OCI chart with both tag and digest specified.
+// This is a regression test for https://github.com/helm/helm/issues/31600
+func TestPullOCIWithTagAndDigest(t *testing.T) {
+	srv := repotest.NewTempServer(
+		t,
+		repotest.WithChartSourceGlob("testdata/testcharts/*.tgz*"),
+	)
+	defer srv.Stop()
+
+	ociSrv, err := repotest.NewOCIServer(t, srv.Root())
+	if err != nil {
+		t.Fatal(err)
+	}
+	ociSrv.Run(t)
+
+	contentCache := t.TempDir()
+	outdir := t.TempDir()
+
+	// Test: pull with tag and digest (the fixed bug from issue #31600)
+	// Previously this failed with "encoding/hex: invalid byte: U+0073 's'"
+	ref := fmt.Sprintf("oci://%s/u/ocitestuser/oci-dependent-chart:0.1.0@%s",
+		ociSrv.RegistryURL, ociSrv.ManifestDigest)
+
+	cmd := fmt.Sprintf("pull %s -d '%s' --registry-config %s --content-cache %s --plain-http",
+		ref,
+		outdir,
+		filepath.Join(srv.Root(), "config.json"),
+		contentCache,
+	)
+
+	_, _, err = executeActionCommand(cmd)
+	if err != nil {
+		t.Fatalf("pull with tag+digest failed: %v", err)
+	}
+
+	// Verify the file was downloaded
+	// When digest is present, the filename uses the digest format
+	expectedFile := filepath.Join(outdir, "oci-dependent-chart-0.1.0.tgz")
+	if _, err := os.Stat(expectedFile); err != nil {
+		// Try the digest-based filename
+		digestPart := ociSrv.ManifestDigest[7:] // strip "sha256:"
+		expectedFile = filepath.Join(outdir, fmt.Sprintf("oci-dependent-chart@sha256-%s.tgz", digestPart))
+		if _, err := os.Stat(expectedFile); err != nil {
+			t.Errorf("expected chart file not found: %v", err)
+		}
+	}
+}
diff --git a/pkg/repo/v1/repotest/server.go b/pkg/repo/v1/repotest/server.go
index 12b96de5a..2e27e1ed9 100644
--- a/pkg/repo/v1/repotest/server.go
+++ b/pkg/repo/v1/repotest/server.go
@@ -140,11 +140,12 @@ func newServer(t *testing.T, docroot string, options ...ServerOption) *Server {
 
 type OCIServer struct {
 	*registry.Registry
-	RegistryURL  string
-	Dir          string
-	TestUsername string
-	TestPassword string
-	Client       *ociRegistry.Client
+	RegistryURL    string
+	Dir            string
+	TestUsername   string
+	TestPassword   string
+	Client         *ociRegistry.Client
+	ManifestDigest string // Digest of the pushed oci-dependent-chart manifest
 }
 
 type OCIServerRunConfig struct {
@@ -282,6 +283,7 @@ func (srv *OCIServer) Run(t *testing.T, opts ...OCIServerOpt) {
 		result.Chart.Digest, result.Chart.Size)
 
 	srv.Client = registryClient
+	srv.ManifestDigest = result.Manifest.Digest
 	c := cfg.DependingChart
 	if c == nil {
 		return