From 87d40c126d42b3e266719ef9c529860aeecc782d Mon Sep 17 00:00:00 2001
From: Brandon Philips <brandon@ifup.org>
Date: Fri, 4 Sep 2020 16:10:13 +0000
Subject: [PATCH 01/28] github: add Asset Transparency action for GitHub
 releases

This adds a GitHub Action to have Helm release inserted into the Asset
Transparency log[1].

With these assets in the log it would be great to also recommend users
verify their download of helm using the Asset Transparency CLI like
this:

```
tl verify https://get.helm.sh/helm-v3.3.1-darwin-amd64.tar.gz helm-v3.3.1-darwin-amd64.tar.gz
```

[1] https://www.transparencylog.com

See kubernetes-dev discussion here:
https://groups.google.com/g/kubernetes-dev/c/iWr5FiOyU78

Signed-off-by: Brandon Philips <brandon@ifup.org>
---
 .github/workflows/asset-transparency.yaml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 .github/workflows/asset-transparency.yaml

diff --git a/.github/workflows/asset-transparency.yaml b/.github/workflows/asset-transparency.yaml
new file mode 100644
index 000000000..7edbea2b0
--- /dev/null
+++ b/.github/workflows/asset-transparency.yaml
@@ -0,0 +1,18 @@
+name: Publish Release Assets to Asset Transparency Log
+
+on:
+  release:
+    types: [published, created, edited, released]
+
+jobs:
+  github_release_asset_transparency_log_publish_job:
+    runs-on: ubuntu-latest
+    name: Publish GitHub release asset digests to https://beta-asset.transparencylog.net
+    steps:
+    - name: Gather URLs from GitHub release and publish
+      id: asset-transparency
+      uses: transparencylog/github-releases-asset-transparency-verify-action@v10
+    - name: List verified and published URLs
+      run: echo "Verified URLs ${{ steps.asset-transparency.outputs.verified }}"
+    - name: List failed URLs
+      run: echo "Failed URLs ${{ steps.asset-transparency.outputs.failed }}"

From 6ef79e432b3c7705173a71a32ed54983c084340c Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Date: Fri, 7 Jan 2022 18:24:09 +0300
Subject: [PATCH 02/28] Add labels support for install action with secret
 storage backend

Signed-off-by: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 cmd/helm/install.go           | 1 +
 pkg/action/install.go         | 6 ++++--
 pkg/storage/driver/secrets.go | 2 ++
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/cmd/helm/install.go b/cmd/helm/install.go
index 0e63ab3a5..5e0d4d01f 100644
--- a/cmd/helm/install.go
+++ b/cmd/helm/install.go
@@ -155,6 +155,7 @@ func addInstallFlags(cmd *cobra.Command, f *pflag.FlagSet, client *action.Instal
 	f.BoolVar(&client.Atomic, "atomic", false, "if set, the installation process deletes the installation on failure. The --wait flag will be set automatically if --atomic is used")
 	f.BoolVar(&client.SkipCRDs, "skip-crds", false, "if set, no CRDs will be installed. By default, CRDs are installed if not already present")
 	f.BoolVar(&client.SubNotes, "render-subchart-notes", false, "if set, render subchart notes along with the parent")
+	f.StringToStringVarP(&client.Labels, "labels", "l", nil, "Labels that would be added to relese metadata. Should be divided by comma. (Currently works only with configmap and secret storage drivers)")
 	addValueOptionsFlags(f, valueOpts)
 	addChartPathOptionsFlags(f, &client.ChartPathOptions)
 
diff --git a/pkg/action/install.go b/pkg/action/install.go
index cd202ccab..b7c906a0f 100644
--- a/pkg/action/install.go
+++ b/pkg/action/install.go
@@ -89,6 +89,7 @@ type Install struct {
 	SubNotes                 bool
 	DisableOpenAPIValidation bool
 	IncludeCRDs              bool
+	Labels                   map[string]string
 	// KubeVersion allows specifying a custom kubernetes version to use and
 	// APIVersions allows a manual set of supported API Versions to be passed
 	// (for things like templating). These are ignored if ClientOnly is false
@@ -253,7 +254,7 @@ func (i *Install) RunWithContext(ctx context.Context, chrt *chart.Chart, vals ma
 		return nil, err
 	}
 
-	rel := i.createRelease(chrt, vals)
+	rel := i.createRelease(chrt, vals, i.Labels)
 
 	var manifestDoc *bytes.Buffer
 	rel.Hooks, manifestDoc, rel.Info.Notes, err = i.cfg.renderResources(chrt, valuesToRender, i.ReleaseName, i.OutputDir, i.SubNotes, i.UseReleaseName, i.IncludeCRDs, i.PostRenderer, i.DryRun)
@@ -484,7 +485,7 @@ func (i *Install) availableName() error {
 }
 
 // createRelease creates a new release object
-func (i *Install) createRelease(chrt *chart.Chart, rawVals map[string]interface{}) *release.Release {
+func (i *Install) createRelease(chrt *chart.Chart, rawVals map[string]interface{}, labels map[string]string) *release.Release {
 	ts := i.cfg.Now()
 	return &release.Release{
 		Name:      i.ReleaseName,
@@ -497,6 +498,7 @@ func (i *Install) createRelease(chrt *chart.Chart, rawVals map[string]interface{
 			Status:        release.StatusUnknown,
 		},
 		Version: 1,
+		Labels:  labels,
 	}
 }
 
diff --git a/pkg/storage/driver/secrets.go b/pkg/storage/driver/secrets.go
index 2e8530d0c..43ac43433 100644
--- a/pkg/storage/driver/secrets.go
+++ b/pkg/storage/driver/secrets.go
@@ -148,6 +148,7 @@ func (secrets *Secrets) Create(key string, rls *rspb.Release) error {
 	var lbs labels
 
 	lbs.init()
+	lbs.fromMap(rls.Labels)
 	lbs.set("createdAt", strconv.Itoa(int(time.Now().Unix())))
 
 	// create a new secret to hold the release
@@ -173,6 +174,7 @@ func (secrets *Secrets) Update(key string, rls *rspb.Release) error {
 	var lbs labels
 
 	lbs.init()
+	lbs.fromMap(rls.Labels)
 	lbs.set("modifiedAt", strconv.Itoa(int(time.Now().Unix())))
 
 	// create a new secret object to hold the release

From 6afad6bb610e5717caa908abc60695033f65d6a2 Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Date: Sat, 8 Jan 2022 21:41:21 +0300
Subject: [PATCH 03/28] Added upgrade --install labels argument support

Signed-off-by: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 cmd/helm/upgrade.go   | 2 ++
 pkg/action/upgrade.go | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/cmd/helm/upgrade.go b/cmd/helm/upgrade.go
index b856073c1..d95bbf359 100644
--- a/cmd/helm/upgrade.go
+++ b/cmd/helm/upgrade.go
@@ -117,6 +117,7 @@ func newUpgradeCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 					instClient.SubNotes = client.SubNotes
 					instClient.Description = client.Description
 					instClient.DependencyUpdate = client.DependencyUpdate
+					instClient.Labels = client.Labels
 
 					rel, err := runInstall(args, instClient, valueOpts, out)
 					if err != nil {
@@ -228,6 +229,7 @@ func newUpgradeCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 	f.IntVar(&client.MaxHistory, "history-max", settings.MaxHistory, "limit the maximum number of revisions saved per release. Use 0 for no limit")
 	f.BoolVar(&client.CleanupOnFail, "cleanup-on-fail", false, "allow deletion of new resources created in this upgrade when upgrade fails")
 	f.BoolVar(&client.SubNotes, "render-subchart-notes", false, "if set, render subchart notes along with the parent")
+	f.StringToStringVarP(&client.Labels, "labels", "l", nil, "Labels that would be added to relese metadata. Should be divided by comma. (Currently works only with configmap and secret storage drivers)")
 	f.StringVar(&client.Description, "description", "", "add a custom description")
 	f.BoolVar(&client.DependencyUpdate, "dependency-update", false, "update dependencies if they are missing before installing the chart")
 	addChartPathOptionsFlags(f, &client.ChartPathOptions)
diff --git a/pkg/action/upgrade.go b/pkg/action/upgrade.go
index c98b524bc..5c8899b9c 100644
--- a/pkg/action/upgrade.go
+++ b/pkg/action/upgrade.go
@@ -92,6 +92,7 @@ type Upgrade struct {
 	SubNotes bool
 	// Description is the description of this operation
 	Description string
+	Labels      map[string]string
 	// PostRender is an optional post-renderer
 	//
 	// If this is non-nil, then after templates are rendered, they will be sent to the
@@ -251,6 +252,7 @@ func (u *Upgrade) prepareUpgrade(name string, chart *chart.Chart, vals map[strin
 		Version:  revision,
 		Manifest: manifestDoc.String(),
 		Hooks:    hooks,
+		Labels:   u.Labels,
 	}
 
 	if len(notesTxt) > 0 {

From ff3e55f65565cd1a7ec5224ab696a821504c3934 Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Date: Sat, 8 Jan 2022 22:01:57 +0300
Subject: [PATCH 04/28] Support configmap storage driver for install/upgrade
 actions --labels argument

Signed-off-by: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 pkg/storage/driver/cfgmaps.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkg/storage/driver/cfgmaps.go b/pkg/storage/driver/cfgmaps.go
index 94c278875..d139218be 100644
--- a/pkg/storage/driver/cfgmaps.go
+++ b/pkg/storage/driver/cfgmaps.go
@@ -157,6 +157,7 @@ func (cfgmaps *ConfigMaps) Create(key string, rls *rspb.Release) error {
 	var lbs labels
 
 	lbs.init()
+	lbs.fromMap(rls.Labels)
 	lbs.set("createdAt", strconv.Itoa(int(time.Now().Unix())))
 
 	// create a new configmap to hold the release
@@ -184,6 +185,7 @@ func (cfgmaps *ConfigMaps) Update(key string, rls *rspb.Release) error {
 	var lbs labels
 
 	lbs.init()
+	lbs.fromMap(rls.Labels)
 	lbs.set("modifiedAt", strconv.Itoa(int(time.Now().Unix())))
 
 	// create a new configmap object to hold the release

From 627ec6a0c66766a7bc1721272c618e9c9eca2c20 Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Date: Sat, 8 Jan 2022 22:57:24 +0300
Subject: [PATCH 05/28] Make superseded releases keep labels

Signed-off-by: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 pkg/storage/driver/cfgmaps.go | 2 ++
 pkg/storage/driver/secrets.go | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/pkg/storage/driver/cfgmaps.go b/pkg/storage/driver/cfgmaps.go
index d139218be..b0eaf49df 100644
--- a/pkg/storage/driver/cfgmaps.go
+++ b/pkg/storage/driver/cfgmaps.go
@@ -78,6 +78,7 @@ func (cfgmaps *ConfigMaps) Get(key string) (*rspb.Release, error) {
 		cfgmaps.Log("get: failed to decode data %q: %s", key, err)
 		return nil, err
 	}
+	r.Labels = obj.ObjectMeta.Labels
 	// return the release object
 	return r, nil
 }
@@ -145,6 +146,7 @@ func (cfgmaps *ConfigMaps) Query(labels map[string]string) ([]*rspb.Release, err
 			cfgmaps.Log("query: failed to decode release: %s", err)
 			continue
 		}
+		rls.Labels = item.ObjectMeta.Labels
 		results = append(results, rls)
 	}
 	return results, nil
diff --git a/pkg/storage/driver/secrets.go b/pkg/storage/driver/secrets.go
index 43ac43433..9cb17e01f 100644
--- a/pkg/storage/driver/secrets.go
+++ b/pkg/storage/driver/secrets.go
@@ -72,6 +72,7 @@ func (secrets *Secrets) Get(key string) (*rspb.Release, error) {
 	}
 	// found the secret, decode the base64 data string
 	r, err := decodeRelease(string(obj.Data["release"]))
+	r.Labels = obj.ObjectMeta.Labels
 	return r, errors.Wrapf(err, "get: failed to decode data %q", key)
 }
 
@@ -136,6 +137,7 @@ func (secrets *Secrets) Query(labels map[string]string) ([]*rspb.Release, error)
 			secrets.Log("query: failed to decode release: %s", err)
 			continue
 		}
+		rls.Labels = item.ObjectMeta.Labels
 		results = append(results, rls)
 	}
 	return results, nil

From 95bb77c261f0965dc4e6ecf938cc754a3006939b Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Date: Sun, 9 Jan 2022 21:59:39 +0300
Subject: [PATCH 06/28] Fix broken tests for configmap and secret storage
 drivers

Signed-off-by: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 pkg/storage/driver/cfgmaps.go   |  6 +++---
 pkg/storage/driver/mock_test.go |  1 +
 pkg/storage/driver/secrets.go   |  6 +++---
 pkg/storage/driver/util.go      | 23 +++++++++++++++++++++++
 4 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/pkg/storage/driver/cfgmaps.go b/pkg/storage/driver/cfgmaps.go
index b0eaf49df..f05541d46 100644
--- a/pkg/storage/driver/cfgmaps.go
+++ b/pkg/storage/driver/cfgmaps.go
@@ -78,7 +78,7 @@ func (cfgmaps *ConfigMaps) Get(key string) (*rspb.Release, error) {
 		cfgmaps.Log("get: failed to decode data %q: %s", key, err)
 		return nil, err
 	}
-	r.Labels = obj.ObjectMeta.Labels
+	r.Labels = filterSystemLabels(obj.ObjectMeta.Labels)
 	// return the release object
 	return r, nil
 }
@@ -107,7 +107,7 @@ func (cfgmaps *ConfigMaps) List(filter func(*rspb.Release) bool) ([]*rspb.Releas
 			continue
 		}
 
-		rls.Labels = item.ObjectMeta.Labels
+		rls.Labels = filterSystemLabels(item.ObjectMeta.Labels)
 
 		if filter(rls) {
 			results = append(results, rls)
@@ -146,7 +146,7 @@ func (cfgmaps *ConfigMaps) Query(labels map[string]string) ([]*rspb.Release, err
 			cfgmaps.Log("query: failed to decode release: %s", err)
 			continue
 		}
-		rls.Labels = item.ObjectMeta.Labels
+		rls.Labels = filterSystemLabels(item.ObjectMeta.Labels)
 		results = append(results, rls)
 	}
 	return results, nil
diff --git a/pkg/storage/driver/mock_test.go b/pkg/storage/driver/mock_test.go
index c0236ece8..948f2eaa5 100644
--- a/pkg/storage/driver/mock_test.go
+++ b/pkg/storage/driver/mock_test.go
@@ -40,6 +40,7 @@ func releaseStub(name string, vers int, namespace string, status rspb.Status) *r
 		Version:   vers,
 		Namespace: namespace,
 		Info:      &rspb.Info{Status: status},
+		Labels:    make(map[string]string),
 	}
 }
 
diff --git a/pkg/storage/driver/secrets.go b/pkg/storage/driver/secrets.go
index 9cb17e01f..e2be9548f 100644
--- a/pkg/storage/driver/secrets.go
+++ b/pkg/storage/driver/secrets.go
@@ -72,7 +72,7 @@ func (secrets *Secrets) Get(key string) (*rspb.Release, error) {
 	}
 	// found the secret, decode the base64 data string
 	r, err := decodeRelease(string(obj.Data["release"]))
-	r.Labels = obj.ObjectMeta.Labels
+	r.Labels = filterSystemLabels(obj.ObjectMeta.Labels)
 	return r, errors.Wrapf(err, "get: failed to decode data %q", key)
 }
 
@@ -99,7 +99,7 @@ func (secrets *Secrets) List(filter func(*rspb.Release) bool) ([]*rspb.Release,
 			continue
 		}
 
-		rls.Labels = item.ObjectMeta.Labels
+		rls.Labels = filterSystemLabels(item.ObjectMeta.Labels)
 
 		if filter(rls) {
 			results = append(results, rls)
@@ -137,7 +137,7 @@ func (secrets *Secrets) Query(labels map[string]string) ([]*rspb.Release, error)
 			secrets.Log("query: failed to decode release: %s", err)
 			continue
 		}
-		rls.Labels = item.ObjectMeta.Labels
+		rls.Labels = filterSystemLabels(item.ObjectMeta.Labels)
 		results = append(results, rls)
 	}
 	return results, nil
diff --git a/pkg/storage/driver/util.go b/pkg/storage/driver/util.go
index e5b846163..f6f97f947 100644
--- a/pkg/storage/driver/util.go
+++ b/pkg/storage/driver/util.go
@@ -30,6 +30,8 @@ var b64 = base64.StdEncoding
 
 var magicGzip = []byte{0x1f, 0x8b, 0x08}
 
+var systemLabels = []string{"name", "owner", "status", "version", "createdAt", "modifiedAt"}
+
 // encodeRelease encodes a release returning a base64 encoded
 // gzipped string representation, or error.
 func encodeRelease(rls *rspb.Release) (string, error) {
@@ -83,3 +85,24 @@ func decodeRelease(data string) (*rspb.Release, error) {
 	}
 	return &rls, nil
 }
+
+// Checks if label is system
+func isSystemLabel(key string) bool {
+	for _, v := range systemLabels {
+		if key == v {
+			return true
+		}
+	}
+	return false
+}
+
+// Removes system labels from labels map
+func filterSystemLabels(lbs map[string]string) map[string]string {
+	result := make(map[string]string)
+	for k, v := range lbs {
+		if !isSystemLabel(k) {
+			result[k] = v
+		}
+	}
+	return result
+}

From c7eedbd9c583933a483917416d5c86bd6704631d Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Date: Mon, 10 Jan 2022 00:07:47 +0300
Subject: [PATCH 07/28] Fix broken tests for SQL storage driver

Signed-off-by: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 pkg/storage/driver/mock_test.go | 1 -
 pkg/storage/driver/util.go      | 5 +++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkg/storage/driver/mock_test.go b/pkg/storage/driver/mock_test.go
index 948f2eaa5..c0236ece8 100644
--- a/pkg/storage/driver/mock_test.go
+++ b/pkg/storage/driver/mock_test.go
@@ -40,7 +40,6 @@ func releaseStub(name string, vers int, namespace string, status rspb.Status) *r
 		Version:   vers,
 		Namespace: namespace,
 		Info:      &rspb.Info{Status: status},
-		Labels:    make(map[string]string),
 	}
 }
 
diff --git a/pkg/storage/driver/util.go b/pkg/storage/driver/util.go
index f6f97f947..96e31afdc 100644
--- a/pkg/storage/driver/util.go
+++ b/pkg/storage/driver/util.go
@@ -104,5 +104,10 @@ func filterSystemLabels(lbs map[string]string) map[string]string {
 			result[k] = v
 		}
 	}
+
+	// Workaround to make tests work while labels storage is not implemented for SQL storage driver
+	if len(result) == 0 {
+		return nil
+	}
 	return result
 }

From 3a2ed70bd3ca502340779fb0a3c8b5d5445121b5 Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Date: Mon, 10 Jan 2022 23:11:48 +0300
Subject: [PATCH 08/28] Added tests for newly introduced util.go functions

Signed-off-by: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 pkg/storage/driver/util_test.go | 74 +++++++++++++++++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100644 pkg/storage/driver/util_test.go

diff --git a/pkg/storage/driver/util_test.go b/pkg/storage/driver/util_test.go
new file mode 100644
index 000000000..557681a81
--- /dev/null
+++ b/pkg/storage/driver/util_test.go
@@ -0,0 +1,74 @@
+/*
+Copyright The Helm Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package driver
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestIsSystemLabel(t *testing.T) {
+	tests := map[string]bool{
+		"name":  true,
+		"owner": true,
+		"test":  false,
+		"NaMe":  false,
+	}
+	for label, result := range tests {
+		if output := isSystemLabel(label); output != result {
+			t.Errorf("Output %t not equal to expected %t", output, result)
+		}
+	}
+}
+
+type filterSystemLabelsTest struct {
+	args, expected map[string]string
+}
+
+var filterSystemLabelsTests = []filterSystemLabelsTest{
+	filterSystemLabelsTest{nil, nil},
+	filterSystemLabelsTest{map[string]string{}, nil},
+	filterSystemLabelsTest{map[string]string{
+		"name":       "name",
+		"owner":      "owner",
+		"status":     "status",
+		"version":    "version",
+		"createdAt":  "createdAt",
+		"modifiedAt": "modifiedAt",
+	}, nil},
+	filterSystemLabelsTest{map[string]string{
+		"StaTus": "status",
+		"name":   "name",
+		"owner":  "owner",
+		"key":    "value",
+	}, map[string]string{
+		"StaTus": "status",
+		"key":    "value",
+	}},
+	filterSystemLabelsTest{map[string]string{
+		"key1": "value1",
+		"key2": "value2",
+	}, map[string]string{
+		"key1": "value1",
+		"key2": "value2",
+	}},
+}
+
+func TestFilterSystemLabels(t *testing.T) {
+	for _, test := range filterSystemLabelsTests {
+		if output := filterSystemLabels(test.args); !reflect.DeepEqual(test.expected, output) {
+			t.Errorf("Expected {%v}, got {%v}", test.expected, output)
+		}
+	}
+}

From 083e66fe2bd0a5c709adf51a8551dcfa80a274b7 Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Date: Mon, 10 Jan 2022 23:20:34 +0300
Subject: [PATCH 09/28] Remove redudant types from util_test.go

Signed-off-by: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 pkg/storage/driver/util_test.go | 67 +++++++++++++++------------------
 1 file changed, 31 insertions(+), 36 deletions(-)

diff --git a/pkg/storage/driver/util_test.go b/pkg/storage/driver/util_test.go
index 557681a81..800049eca 100644
--- a/pkg/storage/driver/util_test.go
+++ b/pkg/storage/driver/util_test.go
@@ -32,43 +32,38 @@ func TestIsSystemLabel(t *testing.T) {
 	}
 }
 
-type filterSystemLabelsTest struct {
-	args, expected map[string]string
-}
-
-var filterSystemLabelsTests = []filterSystemLabelsTest{
-	filterSystemLabelsTest{nil, nil},
-	filterSystemLabelsTest{map[string]string{}, nil},
-	filterSystemLabelsTest{map[string]string{
-		"name":       "name",
-		"owner":      "owner",
-		"status":     "status",
-		"version":    "version",
-		"createdAt":  "createdAt",
-		"modifiedAt": "modifiedAt",
-	}, nil},
-	filterSystemLabelsTest{map[string]string{
-		"StaTus": "status",
-		"name":   "name",
-		"owner":  "owner",
-		"key":    "value",
-	}, map[string]string{
-		"StaTus": "status",
-		"key":    "value",
-	}},
-	filterSystemLabelsTest{map[string]string{
-		"key1": "value1",
-		"key2": "value2",
-	}, map[string]string{
-		"key1": "value1",
-		"key2": "value2",
-	}},
-}
-
 func TestFilterSystemLabels(t *testing.T) {
-	for _, test := range filterSystemLabelsTests {
-		if output := filterSystemLabels(test.args); !reflect.DeepEqual(test.expected, output) {
-			t.Errorf("Expected {%v}, got {%v}", test.expected, output)
+	var tests = [][2]map[string]string{
+		{nil, nil},
+		{map[string]string{}, nil},
+		{map[string]string{
+			"name":       "name",
+			"owner":      "owner",
+			"status":     "status",
+			"version":    "version",
+			"createdAt":  "createdAt",
+			"modifiedAt": "modifiedAt",
+		}, nil},
+		{map[string]string{
+			"StaTus": "status",
+			"name":   "name",
+			"owner":  "owner",
+			"key":    "value",
+		}, map[string]string{
+			"StaTus": "status",
+			"key":    "value",
+		}},
+		{map[string]string{
+			"key1": "value1",
+			"key2": "value2",
+		}, map[string]string{
+			"key1": "value1",
+			"key2": "value2",
+		}},
+	}
+	for _, test := range tests {
+		if output := filterSystemLabels(test[0]); !reflect.DeepEqual(test[1], output) {
+			t.Errorf("Expected {%v}, got {%v}", test[1], output)
 		}
 	}
 }

From f1700e86d19aba6fb7db03eb36261fe2fb38461a Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Date: Tue, 11 Jan 2022 00:53:32 +0300
Subject: [PATCH 10/28] Added unit tests for implemented install/upgrade labels
 logic

Signed-off-by: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 cmd/helm/upgrade_test.go   | 29 +++++++++++++++++++++++
 pkg/action/install_test.go | 15 ++++++++++++
 pkg/action/upgrade_test.go | 47 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 91 insertions(+)

diff --git a/cmd/helm/upgrade_test.go b/cmd/helm/upgrade_test.go
index 8afcb139b..e673ea57b 100644
--- a/cmd/helm/upgrade_test.go
+++ b/cmd/helm/upgrade_test.go
@@ -21,6 +21,7 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"reflect"
 	"strings"
 	"testing"
 
@@ -431,3 +432,31 @@ func TestUpgradeFileCompletion(t *testing.T) {
 	checkFileCompletion(t, "upgrade myrelease", true)
 	checkFileCompletion(t, "upgrade myrelease repo/chart", false)
 }
+
+func TestUpgradeInstallWithLabels(t *testing.T) {
+	releaseName := "funny-bunny-labels"
+	_, _, chartPath := prepareMockRelease(releaseName, t)
+
+	defer resetEnv()()
+
+	store := storageFixture()
+
+	expectedLabels := map[string]string{
+		"key1": "val1",
+		"key2": "val2",
+	}
+	cmd := fmt.Sprintf("upgrade %s --install --labels key1=val1,key2=val2 '%s'", releaseName, chartPath)
+	_, _, err := executeActionCommandC(store, cmd)
+	if err != nil {
+		t.Errorf("unexpected error, got '%v'", err)
+	}
+
+	updatedRel, err := store.Get(releaseName, 1)
+	if err != nil {
+		t.Errorf("unexpected error, got '%v'", err)
+	}
+
+	if !reflect.DeepEqual(updatedRel.Labels, expectedLabels) {
+		t.Errorf("Expected {%v}, got {%v}", expectedLabels, updatedRel.Labels)
+	}
+}
diff --git a/pkg/action/install_test.go b/pkg/action/install_test.go
index 45e5a2670..96c1f2f7d 100644
--- a/pkg/action/install_test.go
+++ b/pkg/action/install_test.go
@@ -717,3 +717,18 @@ func TestNameAndChartGenerateName(t *testing.T) {
 		})
 	}
 }
+
+func TestInstallWithLabels(t *testing.T) {
+	is := assert.New(t)
+	instAction := installAction(t)
+	instAction.Labels = map[string]string{
+		"key1": "val1",
+		"key2": "val2",
+	}
+	res, err := instAction.Run(buildChart(), nil)
+	if err != nil {
+		t.Fatalf("Failed install: %s", err)
+	}
+
+	is.Equal(instAction.Labels, res.Labels)
+}
diff --git a/pkg/action/upgrade_test.go b/pkg/action/upgrade_test.go
index 62922b373..35e1bcac5 100644
--- a/pkg/action/upgrade_test.go
+++ b/pkg/action/upgrade_test.go
@@ -386,5 +386,52 @@ func TestUpgradeRelease_Interrupted_Atomic(t *testing.T) {
 	is.NoError(err)
 	// Should have rolled back to the previous
 	is.Equal(updatedRes.Info.Status, release.StatusDeployed)
+}
+
+func TestUpgradeRelease_Labels(t *testing.T) {
+	is := assert.New(t)
+	upAction := upgradeAction(t)
+
+	rel := releaseStub()
+	rel.Name = "labels"
+	// It's needed to check that suppressed release would keep original labels
+	// Also it's needed for check that original release labels not passed to upgraded release, cause right now this functionality is not implemented and would cause problems with deletion of labels (meant nullifing existing labels)
+	rel.Labels = map[string]string{
+		"key1": "val1",
+		"key2": "val2",
+	}
+	rel.Info.Status = release.StatusDeployed
+
+	err := upAction.cfg.Releases.Create(rel)
+	is.NoError(err)
+
+	upAction.Labels = map[string]string{
+		"key3": "val3",
+		"key4": "val4",
+	}
+	// setting newValues and upgrading
+	res, err := upAction.Run(rel.Name, buildChart(), nil)
+	is.NoError(err)
+
+	// Now make sure it is actually upgraded
+	updatedRes, err := upAction.cfg.Releases.Get(res.Name, 2)
+	is.NoError(err)
+
+	if updatedRes == nil {
+		is.Fail("Updated Release is nil")
+		return
+	}
+	is.Equal(release.StatusDeployed, updatedRes.Info.Status)
+	is.Equal(upAction.Labels, updatedRes.Labels)
+
+	// Now make sure it is suppressed release still contains original labels
+	initialRes, err := upAction.cfg.Releases.Get(res.Name, 1)
+	is.NoError(err)
 
+	if initialRes == nil {
+		is.Fail("Updated Release is nil")
+		return
+	}
+	is.Equal(initialRes.Info.Status, release.StatusSuperseded)
+	is.Equal(initialRes.Labels, rel.Labels)
 }

From 71e55f9b3600e9d62077dc1e59cee3aef2b04601 Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Date: Tue, 11 Jan 2022 00:59:36 +0300
Subject: [PATCH 11/28] Added note to install/upgrade commands that original
 release labels wouldn't be persisted in upgraded release

Signed-off-by: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 cmd/helm/install.go | 2 +-
 cmd/helm/upgrade.go | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/cmd/helm/install.go b/cmd/helm/install.go
index 5e0d4d01f..bdfd66d50 100644
--- a/cmd/helm/install.go
+++ b/cmd/helm/install.go
@@ -155,7 +155,7 @@ func addInstallFlags(cmd *cobra.Command, f *pflag.FlagSet, client *action.Instal
 	f.BoolVar(&client.Atomic, "atomic", false, "if set, the installation process deletes the installation on failure. The --wait flag will be set automatically if --atomic is used")
 	f.BoolVar(&client.SkipCRDs, "skip-crds", false, "if set, no CRDs will be installed. By default, CRDs are installed if not already present")
 	f.BoolVar(&client.SubNotes, "render-subchart-notes", false, "if set, render subchart notes along with the parent")
-	f.StringToStringVarP(&client.Labels, "labels", "l", nil, "Labels that would be added to relese metadata. Should be divided by comma. (Currently works only with configmap and secret storage drivers)")
+	f.StringToStringVarP(&client.Labels, "labels", "l", nil, "Labels that would be added to relese metadata. Should be divided by comma. (Currently works only with configmap and secret storage drivers). Original release labels wouldn't persisted in upgraded release.")
 	addValueOptionsFlags(f, valueOpts)
 	addChartPathOptionsFlags(f, &client.ChartPathOptions)
 
diff --git a/cmd/helm/upgrade.go b/cmd/helm/upgrade.go
index d95bbf359..584816ae9 100644
--- a/cmd/helm/upgrade.go
+++ b/cmd/helm/upgrade.go
@@ -229,7 +229,7 @@ func newUpgradeCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 	f.IntVar(&client.MaxHistory, "history-max", settings.MaxHistory, "limit the maximum number of revisions saved per release. Use 0 for no limit")
 	f.BoolVar(&client.CleanupOnFail, "cleanup-on-fail", false, "allow deletion of new resources created in this upgrade when upgrade fails")
 	f.BoolVar(&client.SubNotes, "render-subchart-notes", false, "if set, render subchart notes along with the parent")
-	f.StringToStringVarP(&client.Labels, "labels", "l", nil, "Labels that would be added to relese metadata. Should be divided by comma. (Currently works only with configmap and secret storage drivers)")
+	f.StringToStringVarP(&client.Labels, "labels", "l", nil, "Labels that would be added to relese metadata. Should be divided by comma. (Currently works only with configmap and secret storage drivers). Original release labels wouldn't persisted in upgraded release.")
 	f.StringVar(&client.Description, "description", "", "add a custom description")
 	f.BoolVar(&client.DependencyUpdate, "dependency-update", false, "update dependencies if they are missing before installing the chart")
 	addChartPathOptionsFlags(f, &client.ChartPathOptions)

From f96acb4fc85f26886142303e14e8b0901dc571dd Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Date: Wed, 12 Jan 2022 00:52:00 +0300
Subject: [PATCH 12/28] Adding support merging new custom labels with original
 release labels during upgrade

Signed-off-by: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 cmd/helm/install.go        |  2 +-
 cmd/helm/upgrade.go        |  2 +-
 pkg/action/upgrade.go      | 12 +++++++++++-
 pkg/action/upgrade_test.go | 26 +++++++++++++++++++++-----
 4 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/cmd/helm/install.go b/cmd/helm/install.go
index bdfd66d50..8b0cbea70 100644
--- a/cmd/helm/install.go
+++ b/cmd/helm/install.go
@@ -155,7 +155,7 @@ func addInstallFlags(cmd *cobra.Command, f *pflag.FlagSet, client *action.Instal
 	f.BoolVar(&client.Atomic, "atomic", false, "if set, the installation process deletes the installation on failure. The --wait flag will be set automatically if --atomic is used")
 	f.BoolVar(&client.SkipCRDs, "skip-crds", false, "if set, no CRDs will be installed. By default, CRDs are installed if not already present")
 	f.BoolVar(&client.SubNotes, "render-subchart-notes", false, "if set, render subchart notes along with the parent")
-	f.StringToStringVarP(&client.Labels, "labels", "l", nil, "Labels that would be added to relese metadata. Should be divided by comma. (Currently works only with configmap and secret storage drivers). Original release labels wouldn't persisted in upgraded release.")
+	f.StringToStringVarP(&client.Labels, "labels", "l", nil, "Labels that would be added to relese metadata. Should be divided by comma. (Currently works only with configmap and secret storage drivers).")
 	addValueOptionsFlags(f, valueOpts)
 	addChartPathOptionsFlags(f, &client.ChartPathOptions)
 
diff --git a/cmd/helm/upgrade.go b/cmd/helm/upgrade.go
index 584816ae9..b08c50e13 100644
--- a/cmd/helm/upgrade.go
+++ b/cmd/helm/upgrade.go
@@ -229,7 +229,7 @@ func newUpgradeCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 	f.IntVar(&client.MaxHistory, "history-max", settings.MaxHistory, "limit the maximum number of revisions saved per release. Use 0 for no limit")
 	f.BoolVar(&client.CleanupOnFail, "cleanup-on-fail", false, "allow deletion of new resources created in this upgrade when upgrade fails")
 	f.BoolVar(&client.SubNotes, "render-subchart-notes", false, "if set, render subchart notes along with the parent")
-	f.StringToStringVarP(&client.Labels, "labels", "l", nil, "Labels that would be added to relese metadata. Should be divided by comma. (Currently works only with configmap and secret storage drivers). Original release labels wouldn't persisted in upgraded release.")
+	f.StringToStringVarP(&client.Labels, "labels", "l", nil, "Labels that would be added to relese metadata. Should be divided by comma. (Currently works only with configmap and secret storage drivers). Original release labels would be merged with upgrade labels. You can unset label using null.")
 	f.StringVar(&client.Description, "description", "", "add a custom description")
 	f.BoolVar(&client.DependencyUpdate, "dependency-update", false, "update dependencies if they are missing before installing the chart")
 	addChartPathOptionsFlags(f, &client.ChartPathOptions)
diff --git a/pkg/action/upgrade.go b/pkg/action/upgrade.go
index 5c8899b9c..44036842a 100644
--- a/pkg/action/upgrade.go
+++ b/pkg/action/upgrade.go
@@ -252,7 +252,7 @@ func (u *Upgrade) prepareUpgrade(name string, chart *chart.Chart, vals map[strin
 		Version:  revision,
 		Manifest: manifestDoc.String(),
 		Hooks:    hooks,
-		Labels:   u.Labels,
+		Labels:   mergeCustomLabels(lastRelease.Labels, u.Labels),
 	}
 
 	if len(notesTxt) > 0 {
@@ -571,3 +571,13 @@ func objectKey(r *resource.Info) string {
 	gvk := r.Object.GetObjectKind().GroupVersionKind()
 	return fmt.Sprintf("%s/%s/%s/%s", gvk.GroupVersion().String(), gvk.Kind, r.Namespace, r.Name)
 }
+
+func mergeCustomLabels(current, desired map[string]string) map[string]string {
+	labels := mergeStrStrMaps(current, desired)
+	for k, v := range labels {
+		if v == "null" {
+			delete(labels, k)
+		}
+	}
+	return labels
+}
diff --git a/pkg/action/upgrade_test.go b/pkg/action/upgrade_test.go
index 35e1bcac5..44113c865 100644
--- a/pkg/action/upgrade_test.go
+++ b/pkg/action/upgrade_test.go
@@ -19,6 +19,7 @@ package action
 import (
 	"context"
 	"fmt"
+	"reflect"
 	"testing"
 	"time"
 
@@ -388,6 +389,21 @@ func TestUpgradeRelease_Interrupted_Atomic(t *testing.T) {
 	is.Equal(updatedRes.Info.Status, release.StatusDeployed)
 }
 
+func TestMergeCustomLabels(t *testing.T) {
+	var tests = [][3]map[string]string{
+		{nil, nil, map[string]string{}},
+		{map[string]string{}, map[string]string{}, map[string]string{}},
+		{map[string]string{"k1": "v1", "k2": "v2"}, nil, map[string]string{"k1": "v1", "k2": "v2"}},
+		{nil, map[string]string{"k1": "v1", "k2": "v2"}, map[string]string{"k1": "v1", "k2": "v2"}},
+		{map[string]string{"k1": "v1", "k2": "v2"}, map[string]string{"k1": "null", "k2": "v3"}, map[string]string{"k2": "v3"}},
+	}
+	for _, test := range tests {
+		if output := mergeCustomLabels(test[0], test[1]); !reflect.DeepEqual(test[2], output) {
+			t.Errorf("Expected {%v}, got {%v}", test[2], output)
+		}
+	}
+}
+
 func TestUpgradeRelease_Labels(t *testing.T) {
 	is := assert.New(t)
 	upAction := upgradeAction(t)
@@ -395,10 +411,9 @@ func TestUpgradeRelease_Labels(t *testing.T) {
 	rel := releaseStub()
 	rel.Name = "labels"
 	// It's needed to check that suppressed release would keep original labels
-	// Also it's needed for check that original release labels not passed to upgraded release, cause right now this functionality is not implemented and would cause problems with deletion of labels (meant nullifing existing labels)
 	rel.Labels = map[string]string{
 		"key1": "val1",
-		"key2": "val2",
+		"key2": "val2.1",
 	}
 	rel.Info.Status = release.StatusDeployed
 
@@ -406,14 +421,15 @@ func TestUpgradeRelease_Labels(t *testing.T) {
 	is.NoError(err)
 
 	upAction.Labels = map[string]string{
+		"key1": "null",
+		"key2": "val2.2",
 		"key3": "val3",
-		"key4": "val4",
 	}
 	// setting newValues and upgrading
 	res, err := upAction.Run(rel.Name, buildChart(), nil)
 	is.NoError(err)
 
-	// Now make sure it is actually upgraded
+	// Now make sure it is actually upgraded and labels were merged
 	updatedRes, err := upAction.cfg.Releases.Get(res.Name, 2)
 	is.NoError(err)
 
@@ -422,7 +438,7 @@ func TestUpgradeRelease_Labels(t *testing.T) {
 		return
 	}
 	is.Equal(release.StatusDeployed, updatedRes.Info.Status)
-	is.Equal(upAction.Labels, updatedRes.Labels)
+	is.Equal(mergeCustomLabels(rel.Labels, upAction.Labels), updatedRes.Labels)
 
 	// Now make sure it is suppressed release still contains original labels
 	initialRes, err := upAction.cfg.Releases.Get(res.Name, 1)

From 68721de93de576d9e7c4aba4569d6169a79a67d3 Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Date: Wed, 12 Jan 2022 01:57:35 +0300
Subject: [PATCH 13/28] Added support for storing custom labels in SQL storage
 driver

Fix list command for SQL storage driver

Fix SQL storage drivers tests after adding custom labels support

Remove notes that SQL driver not supported for storing labels in install and upgrade

Signed-off-by: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 cmd/helm/install.go            |   2 +-
 cmd/helm/upgrade.go            |   2 +-
 pkg/storage/driver/sql.go      | 148 ++++++++++++++++++++++++++++++++-
 pkg/storage/driver/sql_test.go | 105 ++++++++++++++++++-----
 4 files changed, 232 insertions(+), 25 deletions(-)

diff --git a/cmd/helm/install.go b/cmd/helm/install.go
index 8b0cbea70..b8ea59df0 100644
--- a/cmd/helm/install.go
+++ b/cmd/helm/install.go
@@ -155,7 +155,7 @@ func addInstallFlags(cmd *cobra.Command, f *pflag.FlagSet, client *action.Instal
 	f.BoolVar(&client.Atomic, "atomic", false, "if set, the installation process deletes the installation on failure. The --wait flag will be set automatically if --atomic is used")
 	f.BoolVar(&client.SkipCRDs, "skip-crds", false, "if set, no CRDs will be installed. By default, CRDs are installed if not already present")
 	f.BoolVar(&client.SubNotes, "render-subchart-notes", false, "if set, render subchart notes along with the parent")
-	f.StringToStringVarP(&client.Labels, "labels", "l", nil, "Labels that would be added to relese metadata. Should be divided by comma. (Currently works only with configmap and secret storage drivers).")
+	f.StringToStringVarP(&client.Labels, "labels", "l", nil, "Labels that would be added to relese metadata. Should be divided by comma.")
 	addValueOptionsFlags(f, valueOpts)
 	addChartPathOptionsFlags(f, &client.ChartPathOptions)
 
diff --git a/cmd/helm/upgrade.go b/cmd/helm/upgrade.go
index b08c50e13..136fe11e5 100644
--- a/cmd/helm/upgrade.go
+++ b/cmd/helm/upgrade.go
@@ -229,7 +229,7 @@ func newUpgradeCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 	f.IntVar(&client.MaxHistory, "history-max", settings.MaxHistory, "limit the maximum number of revisions saved per release. Use 0 for no limit")
 	f.BoolVar(&client.CleanupOnFail, "cleanup-on-fail", false, "allow deletion of new resources created in this upgrade when upgrade fails")
 	f.BoolVar(&client.SubNotes, "render-subchart-notes", false, "if set, render subchart notes along with the parent")
-	f.StringToStringVarP(&client.Labels, "labels", "l", nil, "Labels that would be added to relese metadata. Should be divided by comma. (Currently works only with configmap and secret storage drivers). Original release labels would be merged with upgrade labels. You can unset label using null.")
+	f.StringToStringVarP(&client.Labels, "labels", "l", nil, "Labels that would be added to relese metadata. Should be divided by comma. Original release labels would be merged with upgrade labels. You can unset label using null.")
 	f.StringVar(&client.Description, "description", "", "add a custom description")
 	f.BoolVar(&client.DependencyUpdate, "dependency-update", false, "update dependencies if they are missing before installing the chart")
 	addChartPathOptionsFlags(f, &client.ChartPathOptions)
diff --git a/pkg/storage/driver/sql.go b/pkg/storage/driver/sql.go
index c8a6ae04f..58a360849 100644
--- a/pkg/storage/driver/sql.go
+++ b/pkg/storage/driver/sql.go
@@ -49,6 +49,7 @@ const postgreSQLDialect = "postgres"
 const SQLDriverName = "SQL"
 
 const sqlReleaseTableName = "releases_v1"
+const sqlCustomLabelsTableName = "custom_labels_v1"
 
 const (
 	sqlReleaseTableKeyColumn        = "key"
@@ -61,6 +62,17 @@ const (
 	sqlReleaseTableOwnerColumn      = "owner"
 	sqlReleaseTableCreatedAtColumn  = "createdAt"
 	sqlReleaseTableModifiedAtColumn = "modifiedAt"
+
+	sqlCustomLabelsTableReleaseKeyColumn       = "releaseKey"
+	sqlCustomLabelsTableReleaseNamespaceColumn = "releaseNamespace"
+	sqlCustomLabelsTableKeyColumn              = "key"
+	sqlCustomLabelsTableValueColumn            = "value"
+)
+
+// Following limits based on k8s labels limits - https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
+const (
+	sqlCustomLabelsTableKeyMaxLenght   = 253 + 1 + 63
+	sqlCustomLabelsTableValueMaxLenght = 63
 )
 
 const (
@@ -150,6 +162,41 @@ func (s *SQL) ensureDBSetup() error {
 					`, sqlReleaseTableName),
 				},
 			},
+			{
+				Id: "custom_labels",
+				Up: []string{
+					fmt.Sprintf(`
+						CREATE TABLE %s (
+							%s VARCHAR(64),
+							%s VARCHAR(67),
+							%s VARCHAR(%d), 
+							%s VARCHAR(%d)
+						);
+						CREATE INDEX ON %s (%s, %s);
+						
+						GRANT ALL ON %s TO PUBLIC;
+						ALTER TABLE %s ENABLE ROW LEVEL SECURITY;
+					`,
+						sqlCustomLabelsTableName,
+						sqlCustomLabelsTableReleaseKeyColumn,
+						sqlCustomLabelsTableReleaseNamespaceColumn,
+						sqlCustomLabelsTableKeyColumn,
+						sqlCustomLabelsTableKeyMaxLenght,
+						sqlCustomLabelsTableValueColumn,
+						sqlCustomLabelsTableValueMaxLenght,
+						sqlCustomLabelsTableName,
+						sqlCustomLabelsTableReleaseKeyColumn,
+						sqlCustomLabelsTableReleaseNamespaceColumn,
+						sqlCustomLabelsTableName,
+						sqlCustomLabelsTableName,
+					),
+				},
+				Down: []string{
+					fmt.Sprintf(`
+						DELETE TABLE %s;
+					`, sqlCustomLabelsTableName),
+				},
+			},
 		},
 	}
 
@@ -180,6 +227,13 @@ type SQLReleaseWrapper struct {
 	ModifiedAt int    `db:"modifiedAt"`
 }
 
+type SQLReleaseCustomLabelWrapper struct {
+	ReleaseKey       string `db:"release_key"`
+	ReleaseNamespace string `db:"release_namespace"`
+	Key              string `db:"key"`
+	Value            string `db:"value"`
+}
+
 // NewSQL initializes a new sql driver.
 func NewSQL(connectionString string, logger func(string, ...interface{}), namespace string) (*SQL, error) {
 	db, err := sqlx.Connect(postgreSQLDialect, connectionString)
@@ -230,13 +284,18 @@ func (s *SQL) Get(key string) (*rspb.Release, error) {
 		return nil, err
 	}
 
+	if release.Labels, err = s.getReleaseCustomLabels(key, s.namespace); err != nil {
+		s.Log("failed to get release %s/%s custom labels: %v", s.namespace, key, err)
+		return nil, err
+	}
+
 	return release, nil
 }
 
 // List returns the list of all releases such that filter(release) == true
 func (s *SQL) List(filter func(*rspb.Release) bool) ([]*rspb.Release, error) {
 	sb := s.statementBuilder.
-		Select(sqlReleaseTableBodyColumn).
+		Select(sqlReleaseTableKeyColumn, sqlReleaseTableNamespaceColumn, sqlReleaseTableBodyColumn).
 		From(sqlReleaseTableName).
 		Where(sq.Eq{sqlReleaseTableOwnerColumn: sqlReleaseDefaultOwner})
 
@@ -264,6 +323,12 @@ func (s *SQL) List(filter func(*rspb.Release) bool) ([]*rspb.Release, error) {
 			s.Log("list: failed to decode release: %v: %v", record, err)
 			continue
 		}
+
+		if release.Labels, err = s.getReleaseCustomLabels(record.Key, record.Namespace); err != nil {
+			s.Log("failed to get release %s/%s custom labels: %v", record.Namespace, record.Key, err)
+			return nil, err
+		}
+
 		if filter(release) {
 			releases = append(releases, release)
 		}
@@ -275,7 +340,7 @@ func (s *SQL) List(filter func(*rspb.Release) bool) ([]*rspb.Release, error) {
 // Query returns the set of releases that match the provided set of labels.
 func (s *SQL) Query(labels map[string]string) ([]*rspb.Release, error) {
 	sb := s.statementBuilder.
-		Select(sqlReleaseTableBodyColumn).
+		Select(sqlReleaseTableKeyColumn, sqlReleaseTableNamespaceColumn, sqlReleaseTableBodyColumn).
 		From(sqlReleaseTableName)
 
 	keys := make([]string, 0, len(labels))
@@ -321,6 +386,12 @@ func (s *SQL) Query(labels map[string]string) ([]*rspb.Release, error) {
 			s.Log("list: failed to decode release: %v: %v", record, err)
 			continue
 		}
+
+		if release.Labels, err = s.getReleaseCustomLabels(record.Key, record.Namespace); err != nil {
+			s.Log("failed to get release %s/%s custom labels: %v", record.Namespace, record.Key, err)
+			return nil, err
+		}
+
 		releases = append(releases, release)
 	}
 
@@ -403,6 +474,36 @@ func (s *SQL) Create(key string, rls *rspb.Release) error {
 		s.Log("failed to store release %s in SQL database: %v", key, err)
 		return err
 	}
+
+	// Filtering labels before insert cause in SQL storage driver system releases are stored in separate columns of release table
+	for k, v := range filterSystemLabels(rls.Labels) {
+		insertLabelsQuery, args, err := s.statementBuilder.
+			Insert(sqlCustomLabelsTableName).
+			Columns(
+				sqlCustomLabelsTableReleaseKeyColumn,
+				sqlCustomLabelsTableReleaseNamespaceColumn,
+				sqlCustomLabelsTableKeyColumn,
+				sqlCustomLabelsTableValueColumn,
+			).
+			Values(
+				key,
+				namespace,
+				k,
+				v,
+			).ToSql()
+
+		if err != nil {
+			defer transaction.Rollback()
+			s.Log("failed to build insert query: %v", err)
+			return err
+		}
+
+		if _, err := transaction.Exec(insertLabelsQuery, args...); err != nil {
+			defer transaction.Rollback()
+			s.Log("failed to write Labels: %v", err)
+			return err
+		}
+	}
 	defer transaction.Commit()
 
 	return nil
@@ -487,10 +588,51 @@ func (s *SQL) Delete(key string) (*rspb.Release, error) {
 		Where(sq.Eq{sqlReleaseTableNamespaceColumn: s.namespace}).
 		ToSql()
 	if err != nil {
-		s.Log("failed to build select query: %v", err)
+		s.Log("failed to build delete query: %v", err)
 		return nil, err
 	}
 
 	_, err = transaction.Exec(deleteQuery, args...)
+	if err != nil {
+		s.Log("failed perform delete query: %v", err)
+		return release, err
+	}
+
+	deleteCustomLabelsQuery, args, err := s.statementBuilder.
+		Delete(sqlCustomLabelsTableName).
+		Where(sq.Eq{sqlCustomLabelsTableReleaseKeyColumn: key}).
+		Where(sq.Eq{sqlCustomLabelsTableReleaseNamespaceColumn: s.namespace}).
+		ToSql()
+
+	if err != nil {
+		s.Log("failed to build delete Labels query: %v", err)
+		return nil, err
+	}
+	_, err = transaction.Exec(deleteCustomLabelsQuery, args...)
 	return release, err
 }
+
+// Get release custom labels from database
+func (s *SQL) getReleaseCustomLabels(key string, namespace string) (map[string]string, error) {
+	query, args, err := s.statementBuilder.
+		Select(sqlCustomLabelsTableKeyColumn, sqlCustomLabelsTableValueColumn).
+		From(sqlCustomLabelsTableName).
+		Where(sq.Eq{sqlCustomLabelsTableReleaseKeyColumn: key,
+			sqlCustomLabelsTableReleaseNamespaceColumn: s.namespace}).
+		ToSql()
+	if err != nil {
+		return nil, err
+	}
+
+	var labelsList = []SQLReleaseCustomLabelWrapper{}
+	if err := s.db.Select(&labelsList, query, args...); err != nil {
+		return nil, err
+	}
+
+	labelsMap := make(map[string]string)
+	for _, i := range labelsList {
+		labelsMap[i.Key] = i.Value
+	}
+
+	return filterSystemLabels(labelsMap), nil
+}
diff --git a/pkg/storage/driver/sql_test.go b/pkg/storage/driver/sql_test.go
index 87b6315b8..1b0bdef86 100644
--- a/pkg/storage/driver/sql_test.go
+++ b/pkg/storage/driver/sql_test.go
@@ -62,6 +62,8 @@ func TestSQLGet(t *testing.T) {
 			),
 		).RowsWillBeClosed()
 
+	mockGetReleaseCustomLabels(mock, key, namespace, rel.Labels)
+
 	got, err := sqlDriver.Get(key)
 	if err != nil {
 		t.Fatalf("Failed to get release: %v", err)
@@ -77,38 +79,42 @@ func TestSQLGet(t *testing.T) {
 }
 
 func TestSQLList(t *testing.T) {
-	body1, _ := encodeRelease(releaseStub("key-1", 1, "default", rspb.StatusUninstalled))
-	body2, _ := encodeRelease(releaseStub("key-2", 1, "default", rspb.StatusUninstalled))
-	body3, _ := encodeRelease(releaseStub("key-3", 1, "default", rspb.StatusDeployed))
-	body4, _ := encodeRelease(releaseStub("key-4", 1, "default", rspb.StatusDeployed))
-	body5, _ := encodeRelease(releaseStub("key-5", 1, "default", rspb.StatusSuperseded))
-	body6, _ := encodeRelease(releaseStub("key-6", 1, "default", rspb.StatusSuperseded))
+	releases := []*rspb.Release{}
+	releases = append(releases, releaseStub("key-1", 1, "default", rspb.StatusUninstalled))
+	releases = append(releases, releaseStub("key-2", 1, "default", rspb.StatusUninstalled))
+	releases = append(releases, releaseStub("key-3", 1, "default", rspb.StatusDeployed))
+	releases = append(releases, releaseStub("key-4", 1, "default", rspb.StatusDeployed))
+	releases = append(releases, releaseStub("key-5", 1, "default", rspb.StatusSuperseded))
+	releases = append(releases, releaseStub("key-6", 1, "default", rspb.StatusSuperseded))
 
 	sqlDriver, mock := newTestFixtureSQL(t)
 
 	for i := 0; i < 3; i++ {
 		query := fmt.Sprintf(
-			"SELECT %s FROM %s WHERE %s = $1 AND %s = $2",
+			"SELECT %s, %s, %s FROM %s WHERE %s = $1 AND %s = $2",
+			sqlReleaseTableKeyColumn,
+			sqlReleaseTableNamespaceColumn,
 			sqlReleaseTableBodyColumn,
 			sqlReleaseTableName,
 			sqlReleaseTableOwnerColumn,
 			sqlReleaseTableNamespaceColumn,
 		)
 
+		rows := mock.NewRows([]string{
+			sqlReleaseTableBodyColumn,
+		})
+		for _, r := range releases {
+			body, _ := encodeRelease(r)
+			rows.AddRow(body)
+		}
 		mock.
 			ExpectQuery(regexp.QuoteMeta(query)).
 			WithArgs(sqlReleaseDefaultOwner, sqlDriver.namespace).
-			WillReturnRows(
-				mock.NewRows([]string{
-					sqlReleaseTableBodyColumn,
-				}).
-					AddRow(body1).
-					AddRow(body2).
-					AddRow(body3).
-					AddRow(body4).
-					AddRow(body5).
-					AddRow(body6),
-			).RowsWillBeClosed()
+			WillReturnRows(rows).RowsWillBeClosed()
+
+		for _, r := range releases {
+			mockGetReleaseCustomLabels(mock, "", r.Namespace, r.Labels)
+		}
 	}
 
 	// list all deleted releases
@@ -181,6 +187,21 @@ func TestSqlCreate(t *testing.T) {
 		ExpectExec(regexp.QuoteMeta(query)).
 		WithArgs(key, sqlReleaseDefaultType, body, rel.Name, rel.Namespace, int(rel.Version), rel.Info.Status.String(), sqlReleaseDefaultOwner, int(time.Now().Unix())).
 		WillReturnResult(sqlmock.NewResult(1, 1))
+
+	labelsQuery := fmt.Sprintf(
+		"INSERT INTO %s (%s,%s,%s,%s) VALUES ($1,$2,$3,$4)",
+		sqlCustomLabelsTableName,
+		sqlCustomLabelsTableReleaseKeyColumn,
+		sqlCustomLabelsTableReleaseNamespaceColumn,
+		sqlCustomLabelsTableKeyColumn,
+		sqlCustomLabelsTableValueColumn,
+	)
+	for k, v := range rel.Labels {
+		mock.
+			ExpectExec(regexp.QuoteMeta(labelsQuery)).
+			WithArgs(key, rel.Namespace, k, v).
+			WillReturnResult(sqlmock.NewResult(1, 1))
+	}
 	mock.ExpectCommit()
 
 	if err := sqlDriver.Create(key, rel); err != nil {
@@ -316,7 +337,9 @@ func TestSqlQuery(t *testing.T) {
 	sqlDriver, mock := newTestFixtureSQL(t)
 
 	query := fmt.Sprintf(
-		"SELECT %s FROM %s WHERE %s = $1 AND %s = $2 AND %s = $3 AND %s = $4",
+		"SELECT %s, %s, %s FROM %s WHERE %s = $1 AND %s = $2 AND %s = $3 AND %s = $4",
+		sqlReleaseTableKeyColumn,
+		sqlReleaseTableNamespaceColumn,
 		sqlReleaseTableBodyColumn,
 		sqlReleaseTableName,
 		sqlReleaseTableNameColumn,
@@ -345,8 +368,12 @@ func TestSqlQuery(t *testing.T) {
 			),
 		).RowsWillBeClosed()
 
+	mockGetReleaseCustomLabels(mock, "", deployedRelease.Namespace, deployedRelease.Labels)
+
 	query = fmt.Sprintf(
-		"SELECT %s FROM %s WHERE %s = $1 AND %s = $2 AND %s = $3",
+		"SELECT %s, %s, %s FROM %s WHERE %s = $1 AND %s = $2 AND %s = $3",
+		sqlReleaseTableKeyColumn,
+		sqlReleaseTableNamespaceColumn,
 		sqlReleaseTableBodyColumn,
 		sqlReleaseTableName,
 		sqlReleaseTableNameColumn,
@@ -367,6 +394,9 @@ func TestSqlQuery(t *testing.T) {
 			),
 		).RowsWillBeClosed()
 
+	mockGetReleaseCustomLabels(mock, "", supersededRelease.Namespace, supersededRelease.Labels)
+	mockGetReleaseCustomLabels(mock, "", deployedRelease.Namespace, deployedRelease.Labels)
+
 	_, err := sqlDriver.Query(labelSetUnknown)
 	if err == nil {
 		t.Errorf("Expected error {%v}, got nil", ErrReleaseNotFound)
@@ -447,6 +477,18 @@ func TestSqlDelete(t *testing.T) {
 		ExpectExec(regexp.QuoteMeta(deleteQuery)).
 		WithArgs(key, namespace).
 		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	deleteLabelsQuery := fmt.Sprintf(
+		"DELETE FROM %s WHERE %s = $1 AND %s = $2",
+		sqlCustomLabelsTableName,
+		sqlCustomLabelsTableReleaseKeyColumn,
+		sqlCustomLabelsTableReleaseNamespaceColumn,
+	)
+	mock.
+		ExpectExec(regexp.QuoteMeta(deleteLabelsQuery)).
+		WithArgs(key, namespace).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
 	mock.ExpectCommit()
 
 	deletedRelease, err := sqlDriver.Delete(key)
@@ -461,3 +503,26 @@ func TestSqlDelete(t *testing.T) {
 		t.Errorf("Expected release {%v}, got {%v}", rel, deletedRelease)
 	}
 }
+
+func mockGetReleaseCustomLabels(mock sqlmock.Sqlmock, key string, namespace string, labels map[string]string) {
+	query := fmt.Sprintf(
+		regexp.QuoteMeta("SELECT %s, %s FROM %s WHERE %s = $1 AND %s = $2"),
+		sqlCustomLabelsTableKeyColumn,
+		sqlCustomLabelsTableValueColumn,
+		sqlCustomLabelsTableName,
+		sqlCustomLabelsTableReleaseKeyColumn,
+		sqlCustomLabelsTableReleaseNamespaceColumn,
+	)
+
+	eq := mock.ExpectQuery(query).
+		WithArgs(key, namespace)
+
+	returnRows := mock.NewRows([]string{
+		sqlCustomLabelsTableKeyColumn,
+		sqlCustomLabelsTableValueColumn,
+	})
+	for k, v := range labels {
+		returnRows.AddRow(k, v)
+	}
+	eq.WillReturnRows(returnRows).RowsWillBeClosed()
+}

From 2f29ccb9d0357c4fcb1f397681da280a4d8288b1 Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Date: Wed, 12 Jan 2022 03:36:12 +0300
Subject: [PATCH 14/28] Make default release fixture contain custom labels to
 make tests check that labels are not lost

Signed-off-by: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 pkg/storage/driver/mock_test.go | 4 ++++
 pkg/storage/driver/util.go      | 5 -----
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/pkg/storage/driver/mock_test.go b/pkg/storage/driver/mock_test.go
index c0236ece8..1f96f04b1 100644
--- a/pkg/storage/driver/mock_test.go
+++ b/pkg/storage/driver/mock_test.go
@@ -40,6 +40,10 @@ func releaseStub(name string, vers int, namespace string, status rspb.Status) *r
 		Version:   vers,
 		Namespace: namespace,
 		Info:      &rspb.Info{Status: status},
+		Labels: map[string]string{
+			"k1": "v1",
+			"k2": "v2",
+		},
 	}
 }
 
diff --git a/pkg/storage/driver/util.go b/pkg/storage/driver/util.go
index 96e31afdc..f6f97f947 100644
--- a/pkg/storage/driver/util.go
+++ b/pkg/storage/driver/util.go
@@ -104,10 +104,5 @@ func filterSystemLabels(lbs map[string]string) map[string]string {
 			result[k] = v
 		}
 	}
-
-	// Workaround to make tests work while labels storage is not implemented for SQL storage driver
-	if len(result) == 0 {
-		return nil
-	}
 	return result
 }

From 512970ab40b150faef23058452d4849b9d9a4106 Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Date: Wed, 12 Jan 2022 03:56:45 +0300
Subject: [PATCH 15/28] Fixing tests after adding labels to release fixture

Signed-off-by: Dmitry Chepurovskiy <dm3ch@dm3ch.net>
Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 pkg/storage/driver/cfgmaps.go   | 3 +++
 pkg/storage/driver/mock_test.go | 4 ++--
 pkg/storage/driver/secrets.go   | 3 +++
 pkg/storage/driver/sql.go       | 5 +++++
 pkg/storage/driver/sql_test.go  | 4 +++-
 pkg/storage/driver/util_test.go | 6 +++---
 6 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/pkg/storage/driver/cfgmaps.go b/pkg/storage/driver/cfgmaps.go
index f05541d46..98bb9ffa4 100644
--- a/pkg/storage/driver/cfgmaps.go
+++ b/pkg/storage/driver/cfgmaps.go
@@ -244,6 +244,9 @@ func newConfigMapsObject(key string, rls *rspb.Release, lbs labels) (*v1.ConfigM
 		lbs.init()
 	}
 
+	// apply custom labels
+	lbs.fromMap(rls.Labels)
+
 	// apply labels
 	lbs.set("name", rls.Name)
 	lbs.set("owner", owner)
diff --git a/pkg/storage/driver/mock_test.go b/pkg/storage/driver/mock_test.go
index 1f96f04b1..7a1541a02 100644
--- a/pkg/storage/driver/mock_test.go
+++ b/pkg/storage/driver/mock_test.go
@@ -41,8 +41,8 @@ func releaseStub(name string, vers int, namespace string, status rspb.Status) *r
 		Namespace: namespace,
 		Info:      &rspb.Info{Status: status},
 		Labels: map[string]string{
-			"k1": "v1",
-			"k2": "v2",
+			"key1": "val1",
+			"key2": "val2",
 		},
 	}
 }
diff --git a/pkg/storage/driver/secrets.go b/pkg/storage/driver/secrets.go
index e2be9548f..e714d2e80 100644
--- a/pkg/storage/driver/secrets.go
+++ b/pkg/storage/driver/secrets.go
@@ -226,6 +226,9 @@ func newSecretsObject(key string, rls *rspb.Release, lbs labels) (*v1.Secret, er
 		lbs.init()
 	}
 
+	// apply custom labels
+	lbs.fromMap(rls.Labels)
+
 	// apply labels
 	lbs.set("name", rls.Name)
 	lbs.set("owner", owner)
diff --git a/pkg/storage/driver/sql.go b/pkg/storage/driver/sql.go
index 58a360849..18f51f3fd 100644
--- a/pkg/storage/driver/sql.go
+++ b/pkg/storage/driver/sql.go
@@ -598,6 +598,11 @@ func (s *SQL) Delete(key string) (*rspb.Release, error) {
 		return release, err
 	}
 
+	if release.Labels, err = s.getReleaseCustomLabels(key, s.namespace); err != nil {
+		s.Log("failed to get release %s/%s custom labels: %v", s.namespace, key, err)
+		return nil, err
+	}
+
 	deleteCustomLabelsQuery, args, err := s.statementBuilder.
 		Delete(sqlCustomLabelsTableName).
 		Where(sq.Eq{sqlCustomLabelsTableReleaseKeyColumn: key}).
diff --git a/pkg/storage/driver/sql_test.go b/pkg/storage/driver/sql_test.go
index 1b0bdef86..2bbe05a9f 100644
--- a/pkg/storage/driver/sql_test.go
+++ b/pkg/storage/driver/sql_test.go
@@ -196,7 +196,7 @@ func TestSqlCreate(t *testing.T) {
 		sqlCustomLabelsTableKeyColumn,
 		sqlCustomLabelsTableValueColumn,
 	)
-	for k, v := range rel.Labels {
+	for k, v := range filterSystemLabels(rel.Labels) {
 		mock.
 			ExpectExec(regexp.QuoteMeta(labelsQuery)).
 			WithArgs(key, rel.Namespace, k, v).
@@ -478,6 +478,8 @@ func TestSqlDelete(t *testing.T) {
 		WithArgs(key, namespace).
 		WillReturnResult(sqlmock.NewResult(0, 1))
 
+	mockGetReleaseCustomLabels(mock, key, namespace, rel.Labels)
+
 	deleteLabelsQuery := fmt.Sprintf(
 		"DELETE FROM %s WHERE %s = $1 AND %s = $2",
 		sqlCustomLabelsTableName,
diff --git a/pkg/storage/driver/util_test.go b/pkg/storage/driver/util_test.go
index 800049eca..5aa9f915b 100644
--- a/pkg/storage/driver/util_test.go
+++ b/pkg/storage/driver/util_test.go
@@ -34,8 +34,8 @@ func TestIsSystemLabel(t *testing.T) {
 
 func TestFilterSystemLabels(t *testing.T) {
 	var tests = [][2]map[string]string{
-		{nil, nil},
-		{map[string]string{}, nil},
+		{nil, map[string]string{}},
+		{map[string]string{}, map[string]string{}},
 		{map[string]string{
 			"name":       "name",
 			"owner":      "owner",
@@ -43,7 +43,7 @@ func TestFilterSystemLabels(t *testing.T) {
 			"version":    "version",
 			"createdAt":  "createdAt",
 			"modifiedAt": "modifiedAt",
-		}, nil},
+		}, map[string]string{}},
 		{map[string]string{
 			"StaTus": "status",
 			"name":   "name",

From 28ab648d3c6d9e9ec2b611c5c2c65fba53c8cb97 Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <me@dm3ch.net>
Date: Fri, 17 Jun 2022 21:35:00 +0300
Subject: [PATCH 16/28] Fix flaky TestSQLCreate test by making sqlmock ignore
 order of sql requests

Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 pkg/storage/driver/sql_test.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkg/storage/driver/sql_test.go b/pkg/storage/driver/sql_test.go
index 2bbe05a9f..4c0c7b668 100644
--- a/pkg/storage/driver/sql_test.go
+++ b/pkg/storage/driver/sql_test.go
@@ -196,6 +196,8 @@ func TestSqlCreate(t *testing.T) {
 		sqlCustomLabelsTableKeyColumn,
 		sqlCustomLabelsTableValueColumn,
 	)
+
+	mock.MatchExpectationsInOrder(false)
 	for k, v := range filterSystemLabels(rel.Labels) {
 		mock.
 			ExpectExec(regexp.QuoteMeta(labelsQuery)).

From 98697c7305deb1b4b749c2dc63d951a0a699b98f Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <me@dm3ch.net>
Date: Fri, 17 Feb 2023 02:56:59 +0300
Subject: [PATCH 17/28] Update cmd/helm/install.go

Co-authored-by: Hugues Alary <hugues.alary@gmail.com>
Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 cmd/helm/install.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cmd/helm/install.go b/cmd/helm/install.go
index b8ea59df0..ee317f14b 100644
--- a/cmd/helm/install.go
+++ b/cmd/helm/install.go
@@ -155,7 +155,7 @@ func addInstallFlags(cmd *cobra.Command, f *pflag.FlagSet, client *action.Instal
 	f.BoolVar(&client.Atomic, "atomic", false, "if set, the installation process deletes the installation on failure. The --wait flag will be set automatically if --atomic is used")
 	f.BoolVar(&client.SkipCRDs, "skip-crds", false, "if set, no CRDs will be installed. By default, CRDs are installed if not already present")
 	f.BoolVar(&client.SubNotes, "render-subchart-notes", false, "if set, render subchart notes along with the parent")
-	f.StringToStringVarP(&client.Labels, "labels", "l", nil, "Labels that would be added to relese metadata. Should be divided by comma.")
+	f.StringToStringVarP(&client.Labels, "labels", "l", nil, "Labels that would be added to release metadata. Should be divided by comma.")
 	addValueOptionsFlags(f, valueOpts)
 	addChartPathOptionsFlags(f, &client.ChartPathOptions)
 

From dafc77df64e44bad4b552c911cd5725641e835f0 Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <me@dm3ch.net>
Date: Fri, 17 Feb 2023 02:57:06 +0300
Subject: [PATCH 18/28] Update cmd/helm/upgrade.go

Co-authored-by: Hugues Alary <hugues.alary@gmail.com>
Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 cmd/helm/upgrade.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cmd/helm/upgrade.go b/cmd/helm/upgrade.go
index 136fe11e5..309b46032 100644
--- a/cmd/helm/upgrade.go
+++ b/cmd/helm/upgrade.go
@@ -229,7 +229,7 @@ func newUpgradeCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 	f.IntVar(&client.MaxHistory, "history-max", settings.MaxHistory, "limit the maximum number of revisions saved per release. Use 0 for no limit")
 	f.BoolVar(&client.CleanupOnFail, "cleanup-on-fail", false, "allow deletion of new resources created in this upgrade when upgrade fails")
 	f.BoolVar(&client.SubNotes, "render-subchart-notes", false, "if set, render subchart notes along with the parent")
-	f.StringToStringVarP(&client.Labels, "labels", "l", nil, "Labels that would be added to relese metadata. Should be divided by comma. Original release labels would be merged with upgrade labels. You can unset label using null.")
+	f.StringToStringVarP(&client.Labels, "labels", "l", nil, "Labels that would be added to release metadata. Should be separated by comma. Original release labels will be merged with upgrade labels. You can unset label using null.")
 	f.StringVar(&client.Description, "description", "", "add a custom description")
 	f.BoolVar(&client.DependencyUpdate, "dependency-update", false, "update dependencies if they are missing before installing the chart")
 	addChartPathOptionsFlags(f, &client.ChartPathOptions)

From 7b13ac9914188d69954966e500cbace18e8e9506 Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <me@dm3ch.net>
Date: Tue, 25 Jul 2023 17:41:14 +0300
Subject: [PATCH 19/28] Added error in case try to supply custom label with
 name of system label during install/upgrade

Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 pkg/action/install.go           |  5 +++++
 pkg/action/install_test.go      | 15 +++++++++++++
 pkg/action/upgrade.go           |  5 +++++
 pkg/action/upgrade_test.go      | 31 ++++++++++++++++++++++++++
 pkg/storage/driver/util.go      | 16 +++++++++++++-
 pkg/storage/driver/util_test.go | 39 +++++++++++++++++++++++++++++++++
 6 files changed, 110 insertions(+), 1 deletion(-)

diff --git a/pkg/action/install.go b/pkg/action/install.go
index 10d83ee70..965a6221e 100644
--- a/pkg/action/install.go
+++ b/pkg/action/install.go
@@ -257,6 +257,11 @@ func (i *Install) RunWithContext(ctx context.Context, chrt *chart.Chart, vals ma
 		return nil, err
 	}
 
+	fmt.Println(driver.ContainsSystemLabels(i.Labels))
+	if driver.ContainsSystemLabels(i.Labels) {
+		return nil, fmt.Errorf("user suplied labels contains system reserved label name. System labels: %+v", driver.GetSystemLabels())
+	}
+
 	rel := i.createRelease(chrt, vals, i.Labels)
 
 	var manifestDoc *bytes.Buffer
diff --git a/pkg/action/install_test.go b/pkg/action/install_test.go
index 96c1f2f7d..6ac7cc17e 100644
--- a/pkg/action/install_test.go
+++ b/pkg/action/install_test.go
@@ -732,3 +732,18 @@ func TestInstallWithLabels(t *testing.T) {
 
 	is.Equal(instAction.Labels, res.Labels)
 }
+
+func TestInstallWithSystemLabels(t *testing.T) {
+	is := assert.New(t)
+	instAction := installAction(t)
+	instAction.Labels = map[string]string{
+		"owner": "val1",
+		"key2":  "val2",
+	}
+	_, err := instAction.Run(buildChart(), nil)
+	if err == nil {
+		t.Fatal("expected an error")
+	}
+
+	is.Equal(fmt.Errorf("user suplied labels contains system reserved label name. System labels: %+v", driver.GetSystemLabels()), err)
+}
diff --git a/pkg/action/upgrade.go b/pkg/action/upgrade.go
index 4667008a7..4151d07fe 100644
--- a/pkg/action/upgrade.go
+++ b/pkg/action/upgrade.go
@@ -239,6 +239,11 @@ func (u *Upgrade) prepareUpgrade(name string, chart *chart.Chart, vals map[strin
 		return nil, nil, err
 	}
 
+	fmt.Println(driver.ContainsSystemLabels(u.Labels))
+	if driver.ContainsSystemLabels(u.Labels) {
+		return nil, nil, fmt.Errorf("user suplied labels contains system reserved label name. System labels: %+v", driver.GetSystemLabels())
+	}
+
 	// Store an upgraded release.
 	upgradedRelease := &release.Release{
 		Name:      name,
diff --git a/pkg/action/upgrade_test.go b/pkg/action/upgrade_test.go
index 44113c865..77656e1c5 100644
--- a/pkg/action/upgrade_test.go
+++ b/pkg/action/upgrade_test.go
@@ -24,6 +24,7 @@ import (
 	"time"
 
 	"helm.sh/helm/v3/pkg/chart"
+	"helm.sh/helm/v3/pkg/storage/driver"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -451,3 +452,33 @@ func TestUpgradeRelease_Labels(t *testing.T) {
 	is.Equal(initialRes.Info.Status, release.StatusSuperseded)
 	is.Equal(initialRes.Labels, rel.Labels)
 }
+
+func TestUpgradeRelease_SystemLabels(t *testing.T) {
+	is := assert.New(t)
+	upAction := upgradeAction(t)
+
+	rel := releaseStub()
+	rel.Name = "labels"
+	// It's needed to check that suppressed release would keep original labels
+	rel.Labels = map[string]string{
+		"key1": "val1",
+		"key2": "val2.1",
+	}
+	rel.Info.Status = release.StatusDeployed
+
+	err := upAction.cfg.Releases.Create(rel)
+	is.NoError(err)
+
+	upAction.Labels = map[string]string{
+		"key1":  "null",
+		"key2":  "val2.2",
+		"owner": "val3",
+	}
+	// setting newValues and upgrading
+	_, err = upAction.Run(rel.Name, buildChart(), nil)
+	if err == nil {
+		t.Fatal("expected an error")
+	}
+
+	is.Equal(fmt.Errorf("user suplied labels contains system reserved label name. System labels: %+v", driver.GetSystemLabels()), err)
+}
diff --git a/pkg/storage/driver/util.go b/pkg/storage/driver/util.go
index 3d47c0fce..c4222f89b 100644
--- a/pkg/storage/driver/util.go
+++ b/pkg/storage/driver/util.go
@@ -88,7 +88,7 @@ func decodeRelease(data string) (*rspb.Release, error) {
 
 // Checks if label is system
 func isSystemLabel(key string) bool {
-	for _, v := range systemLabels {
+	for _, v := range GetSystemLabels() {
 		if key == v {
 			return true
 		}
@@ -106,3 +106,17 @@ func filterSystemLabels(lbs map[string]string) map[string]string {
 	}
 	return result
 }
+
+// Checks if labels array contains system labels
+func ContainsSystemLabels(lbs map[string]string) bool {
+	for k := range lbs {
+		if isSystemLabel(k) {
+			return true
+		}
+	}
+	return false
+}
+
+func GetSystemLabels() []string {
+	return systemLabels
+}
diff --git a/pkg/storage/driver/util_test.go b/pkg/storage/driver/util_test.go
index 5aa9f915b..d16043924 100644
--- a/pkg/storage/driver/util_test.go
+++ b/pkg/storage/driver/util_test.go
@@ -18,6 +18,12 @@ import (
 	"testing"
 )
 
+func TestGetSystemLabel(t *testing.T) {
+	if output := GetSystemLabels(); !reflect.DeepEqual(systemLabels, output) {
+		t.Errorf("Expected {%v}, got {%v}", systemLabels, output)
+	}
+}
+
 func TestIsSystemLabel(t *testing.T) {
 	tests := map[string]bool{
 		"name":  true,
@@ -67,3 +73,36 @@ func TestFilterSystemLabels(t *testing.T) {
 		}
 	}
 }
+
+func TestContainsSystemLabels(t *testing.T) {
+	var tests = []struct {
+		input  map[string]string
+		output bool
+	}{
+		{nil, false},
+		{map[string]string{}, false},
+		{map[string]string{
+			"name":       "name",
+			"owner":      "owner",
+			"status":     "status",
+			"version":    "version",
+			"createdAt":  "createdAt",
+			"modifiedAt": "modifiedAt",
+		}, true},
+		{map[string]string{
+			"StaTus": "status",
+			"name":   "name",
+			"owner":  "owner",
+			"key":    "value",
+		}, true},
+		{map[string]string{
+			"key1": "value1",
+			"key2": "value2",
+		}, false},
+	}
+	for _, test := range tests {
+		if output := ContainsSystemLabels(test.input); !reflect.DeepEqual(test.output, output) {
+			t.Errorf("Expected {%v}, got {%v}", test.output, output)
+		}
+	}
+}

From 9d038a223f7052f04ae3e3eab92784d95d1d9ad8 Mon Sep 17 00:00:00 2001
From: shoce <yogze@icloud.com>
Date: Wed, 26 Jul 2023 01:12:07 +0530
Subject: [PATCH 20/28] use json api url + report curl/wget error on fail

Signed-off-by: shoce <yogze@icloud.com>
---
 scripts/get-helm-3 | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/scripts/get-helm-3 b/scripts/get-helm-3
index 6177ba1a2..4be52c3ed 100755
--- a/scripts/get-helm-3
+++ b/scripts/get-helm-3
@@ -108,11 +108,17 @@ verifySupported() {
 checkDesiredVersion() {
   if [ "x$DESIRED_VERSION" == "x" ]; then
     # Get tag from release URL
-    local latest_release_url="https://github.com/helm/helm/releases"
+    local latest_release_url="https://api.github.com/repos/helm/helm/releases/latest"
+    local latest_release_response=""
     if [ "${HAS_CURL}" == "true" ]; then
-      TAG=$(curl -Ls $latest_release_url | grep 'href="/helm/helm/releases/tag/v3.[0-9]*.[0-9]*\"' | sed -E 's/.*\/helm\/helm\/releases\/tag\/(v[0-9\.]+)".*/\1/g' | head -1)
+      latest_release_response=$( curl -L --silent --show-error --fail "$latest_release_url" 2>&1 || true )
     elif [ "${HAS_WGET}" == "true" ]; then
-      TAG=$(wget $latest_release_url -O - 2>&1 | grep 'href="/helm/helm/releases/tag/v3.[0-9]*.[0-9]*\"' | sed -E 's/.*\/helm\/helm\/releases\/tag\/(v[0-9\.]+)".*/\1/g' | head -1)
+      latest_release_response=$( wget "$latest_release_url" -O - 2>&1 || true )
+    fi
+    TAG=$( echo "$latest_release_response" | grep '"tag_name"' | sed -E 's/.*"(v[0-9\.]+)".*/\1/g' )
+    if [ "x$TAG" == "x" ]; then
+      printf "Could not retrieve the latest release tag information from %s: %s\n" "${latest_release_url}" "${latest_release_response}"
+      exit 1
     fi
   else
     TAG=$DESIRED_VERSION

From 735ff8f92c14256ab8cfaa4dcc1b08af7c63fec0 Mon Sep 17 00:00:00 2001
From: Dmitry Chepurovskiy <me@dm3ch.net>
Date: Sun, 30 Jul 2023 17:57:01 +0300
Subject: [PATCH 21/28] Update pkg/action/install.go

Signed-off-by: Dmitry Chepurovskiy <me@dm3ch.net>
---
 pkg/action/install.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkg/action/install.go b/pkg/action/install.go
index 965a6221e..4a3a67724 100644
--- a/pkg/action/install.go
+++ b/pkg/action/install.go
@@ -257,7 +257,6 @@ func (i *Install) RunWithContext(ctx context.Context, chrt *chart.Chart, vals ma
 		return nil, err
 	}
 
-	fmt.Println(driver.ContainsSystemLabels(i.Labels))
 	if driver.ContainsSystemLabels(i.Labels) {
 		return nil, fmt.Errorf("user suplied labels contains system reserved label name. System labels: %+v", driver.GetSystemLabels())
 	}

From 5c7a63138b70f2493be7ea5245791ba40091b9b2 Mon Sep 17 00:00:00 2001
From: MR ZHAO <62738635+heijian123@users.noreply.github.com>
Date: Mon, 7 Aug 2023 09:48:04 +0800
Subject: [PATCH 22/28] Fix helm may identify achieve of the application/x-gzip
 as application/vnd.ms-fontobject

Signed-off-by: MR ZHAO <62738635+heijian123@users.noreply.github.com>
---
 pkg/chart/loader/archive.go | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pkg/chart/loader/archive.go b/pkg/chart/loader/archive.go
index 8b38cb89f..196e5f81d 100644
--- a/pkg/chart/loader/archive.go
+++ b/pkg/chart/loader/archive.go
@@ -85,7 +85,10 @@ func ensureArchive(name string, raw *os.File) error {
 	if err != nil && err != io.EOF {
 		return fmt.Errorf("file '%s' cannot be read: %s", name, err)
 	}
-	if contentType := http.DetectContentType(buffer); contentType != "application/x-gzip" {
+
+	// Helm may identify achieve of the application/x-gzip as application/vnd.ms-fontobject.
+	// Fix for: https://github.com/helm/helm/issues/12261
+	if contentType := http.DetectContentType(buffer); contentType != "application/x-gzip" && !isGZipApplication(buffer) {
 		// TODO: Is there a way to reliably test if a file content is YAML? ghodss/yaml accepts a wide
 		//       variety of content (Makefile, .zshrc) as valid YAML without errors.
 
@@ -98,6 +101,12 @@ func ensureArchive(name string, raw *os.File) error {
 	return nil
 }
 
+// isGZipApplication checks whether the achieve is of the application/x-gzip type.
+func isGZipApplication(data []byte) bool {
+	sig := []byte("\x1F\x8B\x08")
+	return bytes.HasPrefix(data, sig)
+}
+
 // LoadArchiveFiles reads in files out of an archive into memory. This function
 // performs important path security checks and should always be used before
 // expanding a tarball

From 2011a3191c814ed976b05cb44aa7e9277383422c Mon Sep 17 00:00:00 2001
From: 0xff-dev <stevenshuang521@gmail.com>
Date: Thu, 13 Jul 2023 16:55:46 +0800
Subject: [PATCH 23/28] chore: HTTPGetter add default timeout

Signed-off-by: 0xff-dev <stevenshuang521@gmail.com>

Co-authored-by: bjwswang <bjwswang@gmail.com>
Co-authored-by: Abirdcfly <fp544037857@gmail.com>
---
 pkg/getter/getter.go | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkg/getter/getter.go b/pkg/getter/getter.go
index 653b032fe..3ba72ccde 100644
--- a/pkg/getter/getter.go
+++ b/pkg/getter/getter.go
@@ -172,9 +172,21 @@ func (p Providers) ByScheme(scheme string) (Getter, error) {
 	return nil, errors.Errorf("scheme %q not supported", scheme)
 }
 
+const (
+	// The cost timeout references curl's default connection timeout.
+	// https://github.com/curl/curl/blob/master/lib/connect.h#L40C21-L40C21
+	// The helm commands are usually executed manually. Considering the acceptable waiting time, we reduced the entire request time to 120s.
+	DefaultHTTPTimeout = 120
+)
+
+var defaultOptions = []Option{WithTimeout(time.Second * DefaultHTTPTimeout)}
+
 var httpProvider = Provider{
 	Schemes: []string{"http", "https"},
-	New:     NewHTTPGetter,
+	New: func(options ...Option) (Getter, error) {
+		options = append(options, defaultOptions...)
+		return NewHTTPGetter(options...)
+	},
 }
 
 var ociProvider = Provider{

From 04850dc73dc7a5c7e8d66ccc9d10d273c109598f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 14 Aug 2023 21:41:05 +0000
Subject: [PATCH 24/28] chore(deps): bump github/codeql-action from 2.21.3 to
 2.21.4

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.21.3 to 2.21.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/5b6282e01c62d02e720b81eb8a51204f527c3624...a09933a12a80f87b87005513f0abb1494c27a716)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/codeql-analysis.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index a7b246d3d..09231cb97 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -39,7 +39,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@5b6282e01c62d02e720b81eb8a51204f527c3624 # pinv2.21.3
+      uses: github/codeql-action/init@a09933a12a80f87b87005513f0abb1494c27a716 # pinv2.21.4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -50,7 +50,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@5b6282e01c62d02e720b81eb8a51204f527c3624 # pinv2.21.3
+      uses: github/codeql-action/autobuild@a09933a12a80f87b87005513f0abb1494c27a716 # pinv2.21.4
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -64,4 +64,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@5b6282e01c62d02e720b81eb8a51204f527c3624 # pinv2.21.3
+      uses: github/codeql-action/analyze@a09933a12a80f87b87005513f0abb1494c27a716 # pinv2.21.4

From 758dc0163013baab18bd72718f7a4eb26a32e8e3 Mon Sep 17 00:00:00 2001
From: Ian Zink <ian@replicated.com>
Date: Tue, 15 Aug 2023 12:14:05 -0500
Subject: [PATCH 25/28] Add Ian Zink (z4ce) as triage maintainer

Adds Ian Zink (z4ce) as a triage maintainer

Signed-off-by: Ian Zink <zforce@gmail.com>
---
 OWNERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/OWNERS b/OWNERS
index cbc2cfffc..cc18ea522 100644
--- a/OWNERS
+++ b/OWNERS
@@ -11,6 +11,7 @@ triage:
   - yxxhero
   - zonggen
   - gjenkins8
+  - z4ce
 emeritus:
   - adamreese
   - bacongobbler

From 817e646dfe8a9d6abc35f6f3d974e98cfd2ec650 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 19 Aug 2023 05:53:19 +0000
Subject: [PATCH 26/28] chore(deps): bump github.com/containerd/containerd from
 1.7.0 to 1.7.3

Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd) from 1.7.0 to 1.7.3.
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](https://github.com/containerd/containerd/compare/v1.7.0...v1.7.3)

---
updated-dependencies:
- dependency-name: github.com/containerd/containerd
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod |  6 +++---
 go.sum | 18 +++++++++---------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/go.mod b/go.mod
index 19d346e70..0d57cbdf2 100644
--- a/go.mod
+++ b/go.mod
@@ -10,7 +10,7 @@ require (
 	github.com/Masterminds/squirrel v1.5.4
 	github.com/Masterminds/vcs v1.13.3
 	github.com/asaskevich/govalidator v0.0.0-20200428143746-21a406dcc535
-	github.com/containerd/containerd v1.7.0
+	github.com/containerd/containerd v1.7.3
 	github.com/cyphar/filepath-securejoin v0.2.3
 	github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2
 	github.com/evanphx/json-patch v5.6.0+incompatible
@@ -63,7 +63,7 @@ require (
 	github.com/chai2010/gettext-go v1.0.2 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/docker/cli v23.0.1+incompatible // indirect
+	github.com/docker/cli v23.0.3+incompatible // indirect
 	github.com/docker/distribution v2.8.2+incompatible // indirect
 	github.com/docker/docker v23.0.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.7.0 // indirect
@@ -149,7 +149,7 @@ require (
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4 // indirect
 	google.golang.org/grpc v1.53.0 // indirect
-	google.golang.org/protobuf v1.28.1 // indirect
+	google.golang.org/protobuf v1.29.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/go.sum b/go.sum
index 152848751..b02e38869 100644
--- a/go.sum
+++ b/go.sum
@@ -54,8 +54,8 @@ github.com/Masterminds/squirrel v1.5.4 h1:uUcX/aBc8O7Fg9kaISIUsHXdKuqehiXAMQTYX8
 github.com/Masterminds/squirrel v1.5.4/go.mod h1:NNaOrjSoIDfDA40n7sr2tPNZRfjzjA400rg+riTZj10=
 github.com/Masterminds/vcs v1.13.3 h1:IIA2aBdXvfbIM+yl/eTnL4hb1XwdpvuQLglAix1gweE=
 github.com/Masterminds/vcs v1.13.3/go.mod h1:TiE7xuEjl1N4j016moRd6vezp6e6Lz23gypeXfzXeW8=
-github.com/Microsoft/go-winio v0.6.0 h1:slsWYD/zyx7lCXoZVlvQrj0hPTM1HI4+v1sIda2yDvg=
-github.com/Microsoft/hcsshim v0.10.0-rc.7 h1:HBytQPxcv8Oy4244zbQbe6hnOnx544eL5QPUqhJldz8=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/Microsoft/hcsshim v0.10.0-rc.8 h1:YSZVvlIIDD1UxQpJp0h+dnpLUw+TrY0cx8obKsp3bek=
 github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d h1:UrqY+r/OJnIp5u0s1SbQ8dVfLCZJsnvazdBP5hS4iRs=
 github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
@@ -92,9 +92,9 @@ github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMn
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
-github.com/containerd/containerd v1.7.0 h1:G/ZQr3gMZs6ZT0qPUZ15znx5QSdQdASW11nXTLTM2Pg=
-github.com/containerd/containerd v1.7.0/go.mod h1:QfR7Efgb/6X2BDpTPJRvPTYDE9rsF0FsXX9J8sIs/sc=
-github.com/containerd/continuity v0.3.0 h1:nisirsYROK15TAMVukJOUyGJjz4BNQJBVsNvAXZJ/eg=
+github.com/containerd/containerd v1.7.3 h1:cKwYKkP1eTj54bP3wCdXXBymmKRQMrWjkLSWZZJDa8o=
+github.com/containerd/containerd v1.7.3/go.mod h1:32FOM4/O0RkNg7AjQj3hDzN9cUGtu+HMvaKUNiqCZB8=
+github.com/containerd/continuity v0.4.1 h1:wQnVrjIyQ8vhU2sgOiL5T07jo+ouqc2bnKsv5/EqGhU=
 github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
@@ -106,8 +106,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2 h1:aBfCb7iqHmDEIp6fBvC/hQUddQfg+3qdYjwzaiP9Hnc=
 github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2/go.mod h1:WHNsWjnIn2V1LYOrME7e8KxSeKunYHsxEm4am0BUtcI=
-github.com/docker/cli v23.0.1+incompatible h1:LRyWITpGzl2C9e9uGxzisptnxAn1zfZKXy13Ul2Q5oM=
-github.com/docker/cli v23.0.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v23.0.3+incompatible h1:Zcse1DuDqBdgI7OQDV8Go7b83xLgfhW1eza4HfEdxpY=
+github.com/docker/cli v23.0.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.2+incompatible h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8=
 github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v23.0.3+incompatible h1:9GhVsShNWz1hO//9BNg/dpMnZW25KydO4wtVxWAIbho=
@@ -801,8 +801,8 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
-google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.29.1 h1:7QBf+IK2gx70Ap/hDsOmam3GE0v9HicjfEdAxE62UoM=
+google.golang.org/protobuf v1.29.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

From 3c26d6559ef2ed3fb5c96edb3b8241615342a193 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 21 Aug 2023 21:52:58 +0000
Subject: [PATCH 27/28] chore(deps): bump github.com/rubenv/sql-migrate from
 1.5.1 to 1.5.2

Bumps [github.com/rubenv/sql-migrate](https://github.com/rubenv/sql-migrate) from 1.5.1 to 1.5.2.
- [Commits](https://github.com/rubenv/sql-migrate/compare/v1.5.1...v1.5.2)

---
updated-dependencies:
- dependency-name: github.com/rubenv/sql-migrate
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 0d57cbdf2..dbc0f5557 100644
--- a/go.mod
+++ b/go.mod
@@ -27,7 +27,7 @@ require (
 	github.com/opencontainers/image-spec v1.1.0-rc4
 	github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5
 	github.com/pkg/errors v0.9.1
-	github.com/rubenv/sql-migrate v1.5.1
+	github.com/rubenv/sql-migrate v1.5.2
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.7.0
 	github.com/spf13/pflag v1.0.5
diff --git a/go.sum b/go.sum
index b02e38869..3904f4631 100644
--- a/go.sum
+++ b/go.sum
@@ -426,8 +426,8 @@ github.com/prometheus/procfs v0.8.0 h1:ODq8ZFEaYeCaZOJlZZdJA2AbQR98dSHSM1KW/You5
 github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0uaxHdg830/4=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
-github.com/rubenv/sql-migrate v1.5.1 h1:WsZo4jPQfjmddDTh/suANP2aKPA7/ekN0LzuuajgQEo=
-github.com/rubenv/sql-migrate v1.5.1/go.mod h1:H38GW8Vqf8F0Su5XignRyaRcbXbJunSWxs+kmzlg0Is=
+github.com/rubenv/sql-migrate v1.5.2 h1:bMDqOnrJVV/6JQgQ/MxOpU+AdO8uzYYA/TxFUBzFtS0=
+github.com/rubenv/sql-migrate v1.5.2/go.mod h1:H38GW8Vqf8F0Su5XignRyaRcbXbJunSWxs+kmzlg0Is=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=

From 4e5e68d55c3d4bb385a582e633cfeaa5635981eb Mon Sep 17 00:00:00 2001
From: Bingtan Lu <bingtlu@ebay.com>
Date: Tue, 22 Aug 2023 16:49:59 +0800
Subject: [PATCH 28/28] fix(helm): fix GetPodLogs, the hooks should be sorted
 before get the logs of each hook

Signed-off-by: lubingtan <lubingtan@126.com>
---
 pkg/action/release_testing.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkg/action/release_testing.go b/pkg/action/release_testing.go
index 3522a0c98..3c10cecf8 100644
--- a/pkg/action/release_testing.go
+++ b/pkg/action/release_testing.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"sort"
 	"time"
 
 	"github.com/pkg/errors"
@@ -112,7 +113,9 @@ func (r *ReleaseTesting) GetPodLogs(out io.Writer, rel *release.Release) error {
 		return errors.Wrap(err, "unable to get kubernetes client to fetch pod logs")
 	}
 
-	for _, h := range rel.Hooks {
+	hooksByWight := append([]*release.Hook{}, rel.Hooks...)
+	sort.Stable(hookByWeight(hooksByWight))
+	for _, h := range hooksByWight {
 		for _, e := range h.Events {
 			if e == release.HookTest {
 				if contains(r.Filters[ExcludeNameFilter], h.Name) {