Closes#32396.
StampModTimes now normalizes the supplied time to UTC and truncates to
whole seconds before stamping. Without this, an SDK caller passing a
local-timezone or sub-second time.Time would produce a Chart.lock
generated: field with a timezone offset or fractional seconds, making
the lock file content non-reproducible across machines even when the
same SOURCE_DATE_EPOCH value is used — defeating the purpose of the
feature.
Also add:
- testdata/charts/chart-with-lock fixture: a minimal chart with a
Chart.lock whose generated: timestamp predates SOURCE_DATE_EPOCH.
- TestRunWithSourceDateEpochStampsLockGenerated: packages the fixture
with SourceDateEpoch set to a non-UTC, sub-second time.Time and
asserts that the resulting archive's Chart.lock entry has both the
correct tar modtime and the correct (normalized) generated: value in
the marshaled YAML.
Signed-off-by: Ilya Kiselev <kis-ilya-a@yandex.ru>
- Stamp chart.Metadata.RepoURL in Install/Upgrade actions instead of
pkg/cmd, so library consumers also get provenance recorded.
- Don't mislabel local installs as path; fill RepoURL only for
resolved repos, OCI refs, and absolute http(s) URLs.
- Unexport ChartDownloader.RepositoryURL; expose via accessor to
preserve ABI for downstream unkeyed-struct users.
- Fix render test template to use .Chart.RepoURL.
Signed-off-by: Aleksei Krugliak <aleksei.krugliak@altenar.com>
* fix: fixed bug in Dependency.List()
A bug in Dependency.List() caused all compressed charts to flag their dependencies as "missing".
Closes#4431
Signed-off-by: Matt Butcher <matt.butcher@microsoft.com>
* removed some files from test fixtures
Signed-off-by: Matt Butcher <matt.butcher@microsoft.com>
Aleksei Krugliak
Ilya Kiselev
Matheus Pimenta
Aleksei Krugliak
Nathan Baulch
Matt Butcher
Karuppiah Natarajan
Adam Reese
Torsten Walter