Scott Rigby
78cf5470d1
Merge pull request #31199 from TerryHowe/fix-flaky-registry-data-race
...
fix: flaky registry data race on mockdns close
11 hours ago
Scott Rigby
8602422b7a
Merge pull request #31064 from kamilswiec/main
...
lint: throw warning when chart version is not semverv2
11 hours ago
Scott Rigby
50358d7ffd
Merge pull request #31200 from TerryHowe/fix-install-tests
...
fix: installer action goroutine count
11 hours ago
Matt Farina
fc22b6df31
Merge pull request #31222 from benoittgt/30987-ghcr-io
...
Prevent failing `helm push` on ghcr.io using standard GET auth token flow
2 days ago
Robert Sirchia
191154640f
Merge pull request #31197 from tzchenxixi/main
...
chore: fix function name
2 days ago
Kamil Swiechowski
38d1a7376f
fix: throw warning when chart version is not semverv2
...
Signed-off-by: Kamil Swiechowski <kamil.swiechowski@iprally.com>
2 days ago
Matt Farina
618b14a772
Merge pull request #31225 from mattfarina/move-lint-to-chart
...
Move lint pkg to be part of each chart version
3 days ago
George Jenkins
a8151ef4fe
Cleanup plugin config
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
3 days ago
Scott Rigby
ed6cab39c6
Merge pull request #31219 from gjenkins8/gjenkins/plugin-integration/rm_setup_plugin_env
3 days ago
Matt Farina
9dcc49cbd5
Move lint pkg to be part of each chart version
...
Linting is specific to the chart versions. A v2 and v3 chart will
lint differently.
To accomplish this, packages like engine need to be able to handle
different chart versions. This was accomplished by some changes:
1. The introduction of a Charter interface for charts
2. The ChartAccessor which is able to accept a chart and then
provide access to its data via an interface. There is an
interface, factory, and implementation for each version of
chart.
3. Common packages were moved to a common and util packages.
Due to some package loops, there are 2 packages which may
get some consolidation in the future.
The new interfaces provide the foundation to move the actions
and cmd packages to be able to handle multiple apiVersions of
charts.
Signed-off-by: Matt Farina <matt.farina@suse.com>
3 days ago
Matt Farina
52267ee74b
Move repo package to versioned directory
...
The repo package is internally versioned at v1. Repos were designed
to be versioned. This change moves it to a versioned directory the
same way other packages are now being handled.
Signed-off-by: Matt Farina <matt.farina@suse.com>
3 days ago
Matt Farina
6f957f4922
Move the release util to the versioned directory
...
The release util package is directly related to the v1 of
releases and uses the v1 of releases.
Signed-off-by: Matt Farina <matt.farina@suse.com>
3 days ago
George Jenkins
5926ec83dd
Remove SetupPluginEnv
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
4 days ago
George Jenkins
665c5a1fc9
Merge pull request #31224 from gjenkins8/gjenkins/postrenderer_plugin_message_value
...
fix: Adjust PostRenderer plugin output to value
4 days ago
George Jenkins
d99d732542
fix: Adjust PostRenderer plugin output to value
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
4 days ago
Benoit Tigeot
5595c0d005
Prevent failing helm push on ghcr.io using standard GET auth token flow
...
Fix GHCR auth by not forcing OAuth2 POST but also reset
ForceAttemptOAuth2 after login.
- Remove ForceAttemptOAuth2 in NewClient and only enable during Login
ping and always restore to false.
- Aligns with OCI Distribution auth (token via GET), avoiding GHCR 405
on POST /token.
- Some tests
Failures logs:
```sh
~/p/lifen/test/helm-f/quicktest ❯ ../../../helm/bin/helm push quicktest-0.1.0.tgz oci://ghcr.io/benoittgt/helm-charts --debug
level=DEBUG msg=HEAD id=0 url=https://ghcr.io/v2/benoittgt/helm-charts/quicktest/manifests/sha256:af359fd8fb968ec1097afbd6e8e1dac9ee130861082e54dc2340d0c019407873 header=" \"Accept\": \"application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, application/vnd.oci.artifact.manifest.v1+json\"\n \"User-Agent\": \"Helm/4.0+unreleased\""
level=DEBUG msg=Resp id=0 status="401 Unauthorized" header=" \"Www-Authenticate\": \"Bearer realm=\\\"https://ghcr.io/token \\\",service=\\\"ghcr.io\\\",scope=\\\"repository:benoittgt/helm-charts/quicktest:pull\\\"\"\n \"Date\": \"Mon, 01 Sep 2025 13:56:35 GMT\"\n \"Content-Length\": \"73\"\n \"X-Github-Request-Id\": \"DC73:115F:2B40F2C:2BAB567:68B5A613\"\n \"Content-Type\": \"application/json\"" body=" Response body is empty"
level=DEBUG msg=POST id=1 url=https://ghcr.io/token header=" \"Content-Type\": \"application/x-www-form-urlencoded\"\n \"User-Agent\": \"Helm/4.0+unreleased\""
level=DEBUG msg=Resp id=1 status="405 Method Not Allowed" header=" \"Docker-Distribution-Api-Version\": \"registry/2.0\"\n \"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\"\n \"Date\": \"Mon, 01 Sep 2025 13:56:35 GMT\"\n \"Content-Length\": \"78\"\n \"X-Github-Request-Id\": \"DC73:115F:2B40F75:2BAB5C2:68B5A613\"\n \"Content-Type\": \"application/json\"" body="{\"errors\":[{\"code\":\"UNSUPPORTED\",\"message\":\"The operation is unsupported.\"}]}\n"
Error: failed to perform "Exists" on destination: HEAD "https://ghcr.io/v2/benoittgt/helm-charts/quicktest/manifests/sha256:af359fd8fb968ec1097afbd6e8e1dac9ee130861082e54dc2340d0c019407873 ": POST "https://ghcr.io/token ": response status code 405: unsupported: The operation is unsupported.
```
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
4 days ago
tzchenxixi
89aca09e5e
chore: fix function name
...
Signed-off-by: tzchenxixi <tzchenxixi@icloud.com>
4 days ago
George Jenkins
c35755a197
Remove legacy Command/Hooks from v1 Subprocess ( #23 )
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
4 days ago
Scott Rigby
591d863df5
Move Postrenderer to a plugin type
...
Fix/add back postrenderer args unit tests
Signed-off-by: Scott Rigby <scott@r6by.com>
5 days ago
Scott Rigby
e814ff3c38
Remove unnecessary file i/o operations from signing and verifying
...
Signed-off-by: Scott Rigby <scott@r6by.com>
6 days ago
Scott Rigby
9ea35da0d0
[HIP-0026] Plugin packaging, signing, and verification ( #31176 )
...
* Plugin packaging, signing and verification
Signed-off-by: Scott Rigby <scott@r6by.com>
* wrap keyring read error with more explicit message
Co-authored-by: Jesse Simpson <jesse.simpson36@gmail.com>
Signed-off-by: Scott Rigby <scott@r6by.com>
* skip unnecessary check
Co-authored-by: Evans Mungai <mbuevans@gmail.com>
Signed-off-by: Scott Rigby <scott@r6by.com>
* Change behavior for installing plugin with missing .prov file (now warns and continues instead of failing)
Signed-off-by: Scott Rigby <scott@r6by.com>
* Add comprehensive plugin verification tests
- Test missing .prov files (warns but continues)
- Test invalid .prov file formats (fails verification)
- Test hash mismatches in .prov files (fails verification)
- Test .prov file access errors (fails appropriately)
- Test directory plugins don't support verification
- Test installation without verification enabled (succeeds)
- Test with valid .prov files (fails on empty keyring as expected)
---------
Signed-off-by: Scott Rigby <scott@r6by.com>
Co-authored-by: Jesse Simpson <jesse.simpson36@gmail.com>
Co-authored-by: Evans Mungai <mbuevans@gmail.com>
6 days ago
Terry Howe
b12cd28503
fix: installer action goroutine count
...
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
1 week ago
George Jenkins
892e86182f
Merge pull request #31194 from gjenkins8/gjenkins/plugin-integration/wasm_runtime
...
[HIP-0026] Plugin extism/v1 runtime
1 week ago
George Jenkins
80f659ce8b
Merge pull request #31178 from mattfarina/env-content-cache
...
Add content cache to helm env
1 week ago
George Jenkins
2658a00863
fix output message value
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
1 week ago
Terry Howe
ce97a2449e
fix: move mockdns to packge level
...
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
1 week ago
Terry Howe
6273f9b38e
fix: flaky registry data race on mockdns close
...
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
1 week ago
George Jenkins
b6545e903a
code review + bug fixes
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
1 week ago
George Jenkins
934f761e08
Merge pull request #30812 from gjenkins8/gjenkins/chartrelease_server_side_apply
...
HIP-0023: Helm support server-side apply
1 week ago
Scott Rigby
fd41fdd9c9
New registry plugin func GetPluginName. Re-use regsitry.reference
...
Signed-off-by: Scott Rigby <scott@r6by.com>
1 week ago
Scott Rigby
7d22bb25fa
Plugin OCI installer
...
Signed-off-by: Scott Rigby <scott@r6by.com>
1 week ago
Matt Farina
533eddc57d
Add content cache to helm env
...
Signed-off-by: Matt Farina <matt.farina@suse.com>
2 weeks ago
Scott Rigby
a7578fec74
Plugin types and plugin apiVersion v1
...
Co-authored-by: George Jenkins <gvjenkins@gmail.com>
Signed-off-by: Scott Rigby <scott@r6by.com>
2 weeks ago
Scott Rigby
be74ab72a0
[HIP-0026] Plugin runtime interface ( #31145 )
...
* Runtime abstraction to encapsulate subprocess code and enable future runtimes
Also fix race condition in TestPrepareCommandExtraArgs by replacing the shared variable modification with a local copy
Co-authored-by: George Jenkins <gvjenkins@gmail.com>
Signed-off-by: Scott Rigby <scott@r6by.com>
* Remove commented out code
Co-authored-by: Joe Julian <me@joejulian.name>
Signed-off-by: Scott Rigby <scott@r6by.com>
* Check test failure string
Co-authored-by: Jesse Simpson <jesse.simpson36@gmail.com>
Signed-off-by: Scott Rigby <scott@r6by.com>
---------
Signed-off-by: Scott Rigby <scott@r6by.com>
Co-authored-by: George Jenkins <gvjenkins@gmail.com>
Co-authored-by: Joe Julian <me@joejulian.name>
Co-authored-by: Jesse Simpson <jesse.simpson36@gmail.com>
2 weeks ago
Matt Farina
0f1b410f14
Merge pull request #31165 from mattfarina/content-cache
...
Initial addition of content based cache
2 weeks ago
George Jenkins
a0d6b0d383
Merge pull request #13629 from gjenkins8/rename_atomic_rollbackonfailure
...
Rename 'atomic' -> 'rollback-on-failure'
2 weeks ago
Scott Rigby
29d12ba09e
Merge pull request #31156 from estroz/fix-resolve-client
...
fix: set repo authorizer in registry.Client.Resolve()
2 weeks ago
Robert Sirchia
fc5bd02a1b
Merge pull request #31175 from cuiweixie/atomic.Uint64
...
pkg/register: refactor to use atomic.Uint64
2 weeks ago
Matt Farina
fea6d8eb04
Updating to tested content cache
...
A few things are added here:
1. The cache is made to be more generic as a content based cache.
It could be used for other things such as plugins
2. Flags were added to specify the content cache locaiton rather
than rely on the repository cache. Keeping the 2 the same
hid bugs and errors.
3. Tests were added and updated to ensure the cache is used and
tested
Signed-off-by: Matt Farina <matt.farina@suse.com>
2 weeks ago
George Jenkins
4596c0e062
Merge pull request #31142 from helm/gjenkins/main/mv_plugin_internal
...
[HIP-0026] Move pkg/plugin -> internal/plugin
2 weeks ago
cuiweixie
04cb1bad67
pkg/register: refactor to use atomic.Uint64
...
Signed-off-by: cuiweixie <cuiweixie@gmail.com>
2 weeks ago
George Jenkins
ebc874ef84
fix client-side to server-side field manager migration
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
2 weeks ago
Robert Sirchia
30404b4173
Merge pull request #31138 from islewis/release-3.18
...
fix(helm-lint): Add HTTP/HTTPS URL support for json schema references
2 weeks ago
Isaiah Lewis
62e0c78ef8
fix(helm-lint): fmt
...
Signed-off-by: Isaiah Lewis <isaiah@roof12.com>
2 weeks ago
Matt Farina
6ac2c34689
Initial addition of content based cache
...
The previous cache was based on chart name and version. If 2 charts
with different content had the same name and version they would collide.
Helm did not trust the cache because of this and always downloaded
content. It was a short lived cache.
This commit introduces a content based cache which is based on the
content rather than file name. Charts with the same name but different
content are no longer an issue.
While the system assumes a file based interface, the cache system
is pluggable. In the future, it should return bytes for the content
instead of paths to it. That would requie a larger change for Helm 5
or later.
Signed-off-by: Matt Farina <matt.farina@suse.com>
2 weeks ago
Matt Farina
3726d01c5c
Merge pull request #31132 from joemicky/main
...
refactor: replace []byte(fmt.Sprintf) with fmt.Appendf
2 weeks ago
Eric Stroczynski
e1e23d2af1
fix: set repo authorizer in registry.Client.Resolve()
...
Signed-off-by: Eric Stroczynski <estroczynski@nvidia.com>
3 weeks ago
George Jenkins
b4b2392f7e
mergefix
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
3 weeks ago
Isaiah Lewis
fb12b44493
fix(helm-lint): Add TLSClientConfig
...
Signed-off-by: Isaiah Lewis <isaiah@roof12.com>
3 weeks ago
Matt Farina
de9ea4d1e3
Merge pull request #30992 from TerryHowe/force-oath-v4
...
fix: force bearer oauth for if registry requests bearer auth
3 weeks ago