diff --git a/internal/resolver/resolver.go b/internal/resolver/resolver.go index de0634093..9c65d2965 100644 --- a/internal/resolver/resolver.go +++ b/internal/resolver/resolver.go @@ -57,6 +57,11 @@ func (r *Resolver) Resolve(reqs []*chart.Dependency, repoNames map[string]string locked := make([]*chart.Dependency, len(reqs)) missing := []string{} for i, d := range reqs { + constraint, err := semver.NewConstraint(d.Version) + if err != nil { + return nil, errors.Wrapf(err, "dependency %q has an invalid version/constraint format", d.Name) + } + if d.Repository == "" { // Local chart subfolder if _, err := GetLocalPath(filepath.Join("charts", d.Name), r.chartpath); err != nil { @@ -77,13 +82,22 @@ func (r *Resolver) Resolve(reqs []*chart.Dependency, repoNames map[string]string return nil, err } - // The version of the chart locked will be the version of the chart - // currently listed in the file system within the chart. ch, err := loader.LoadDir(chartpath) if err != nil { return nil, err } + v, err := semver.NewVersion(ch.Metadata.Version) + if err != nil { + // Not a legit entry. + continue + } + + if !constraint.Check(v) { + missing = append(missing, d.Name) + continue + } + locked[i] = &chart.Dependency{ Name: d.Name, Repository: d.Repository, @@ -92,11 +106,6 @@ func (r *Resolver) Resolve(reqs []*chart.Dependency, repoNames map[string]string continue } - constraint, err := semver.NewConstraint(d.Version) - if err != nil { - return nil, errors.Wrapf(err, "dependency %q has an invalid version/constraint format", d.Name) - } - repoName := repoNames[d.Name] // if the repository was not defined, but the dependency defines a repository url, bypass the cache if repoName == "" && d.Repository != "" { diff --git a/internal/resolver/resolver_test.go b/internal/resolver/resolver_test.go index 204a72622..bc84ba952 100644 --- a/internal/resolver/resolver_test.go +++ b/internal/resolver/resolver_test.go @@ -28,6 +28,18 @@ func TestResolve(t *testing.T) { expect *chart.Lock err bool }{ + { + name: "repo from invalid version", + req: []*chart.Dependency{ + {Name: "base", Repository: "file://base", Version: "1.1.0"}, + }, + expect: &chart.Lock{ + Dependencies: []*chart.Dependency{ + {Name: "base", Repository: "file://base", Version: "0.1.0"}, + }, + }, + err: true, + }, { name: "version failure", req: []*chart.Dependency{