21 Commits (42a04c76a48e6cdbd19debf042b2c9df34cf9ac6)

Author	SHA1	Message	Date
Ashley Davis	0ab44aef70	add more error checks during the signing process ... Before this change, several of the potential errors during the process of signing a package were skipped. Crucially, `Close()`ing the ReadCloser from the gpg clearsigner is the call which actually does the signing, and so has several points of failure which are ignored; for example, if there's a problem with the format of the key. Also changes the error from messageBlock() to be propagated rather than being swallowed, and adds a test for the case where a signer fails to sign. Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>	3 years ago
Josh Dolitsky	889c70b729	Add nolint comments ... Signed-off-by: Josh Dolitsky <josh@dolit.ski>	3 years ago
Matt Butcher	0e42a77ae6	improved the error message for failed package signing (#6948) ... Signed-off-by: Matt Butcher <matt.butcher@microsoft.com>	5 years ago
Matt Farina	9bc7934f35	Updating the module for v3 as the major version ... Signed-off-by: Matt Farina <matt@mattfarina.com>	5 years ago
Taylor Thomas	9b87721c1f	fix(provenance): Ports error check for `Digest` to v3 ... This is a port of #5672 Signed-off-by: Taylor Thomas <taylor.thomas@microsoft.com>	5 years ago
Oleg Sidorov	ec440d446d	Replaced ghodss/yaml with sigs.k8s.io/yaml ... This commit replaces usage of github.com/ghodss/yaml with it's forked version maintained by SIG community. The replaced library has low-to-none support activity unlike the latter. We believe the new Helm branch could benefit from using the community-supported version on a long-term run as yaml parser is a key component of Helm chart rendering engine. This commit locks sigs.k8s.io/yaml dependency version on 1.1.0 which is backwards compatible with ghodss/yaml 1.0.0. This change also resolves the outdated dependency version lock for ghodss/yaml (currently 1.0.0) and makes it possible to port changes from https://github.com/helm/helm/pull/6010 to dev-v3. Signed-off-by: Oleg Sidorov <oleg.sidorov@booking.com>	6 years ago
Adam Reese	e458a67f0c	ref(pkg/chart): add validation method to chart ... Consolidate validation of Chart.yaml. Signed-off-by: Adam Reese <adam@reese.io>	6 years ago
Adam Reese	895e9192d4	feat(*): use vanity import helm.sh/helm ... Signed-off-by: Adam Reese <adam@reese.io>	6 years ago
Adam Reese	4f26b658d8	change copyright to "Copyright The Helm Authors"	6 years ago
Adam Reese	f012940d9c	ref(*): refactor chart/chartutil ... ref(chartutil): move chart loading out of chartutil into new package add chart loader interface to allow lazy loading feat(chart): create chart accessors ref(*): cleanup requirements ref(tiller): remove optional template engines ref(tiller): simplify sorting releases and hooks ref(*): code simplification ref(hapi): move chart package out of hapi ref(chart): add requirements and lock to Chart struct	6 years ago
Adam Reese	726e3c41be	feat(*): print stacktrace on error with debug enabled	7 years ago
Adam Reese	6345f04190	ref(hapi): convert protobuf to go types	7 years ago
Adam Reese	0c6b6d1c62	fix(*): correct file permissions on source files	8 years ago
Matt Butcher	58dcef86c8	fix(helm): give different error if key is not private ... Previously, a "not found" error was returned if a key exists, but is not a private key. Updated the error to better indicate the case.	8 years ago
Matt Butcher	9ae97c341c	fix(helm): read passphrase from prompt ... This prompts the user to enter a passphrase if the given PGP key is encrypted. Closes #1447	8 years ago
Matt Butcher	1c6fc9c0e8	feat(helm): remove the requirement that fetch/install need version ... This removes the requirement that a fetch or install command must explicitly state the version number to install. Instead, this goes to the strategy used by OS package managers: Install the latest until told to do otherwise. Closes #1198	8 years ago
Matt Butcher	a5921faf99	feat(chartutils): add support for requirements.yaml	8 years ago
Brandon Philips	dadb026afe	fix(helm): avoid a panic for sign ... Before this fix: ``` /Users/philips/src/k8s.io/helm/bin/helm package --sign mychart --key FC8A365E panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0x13120a] goroutine 1 [running]: panic(0x10fed00, 0xc4200120d0) /usr/local/Cellar/go/1.7.1/libexec/src/runtime/panic.go:500 +0x1a1 k8s.io/helm/pkg/provenance.(*Signatory).ClearSign(0xc4205db100, 0xc42011ec20, 0x20, 0x8, 0xc4205db100, 0x0, 0x0) /Users/philips/src/k8s.io/helm/pkg/provenance/sign.go:156 +0x3a main.(*packageCmd).clearsign(0xc420017720, 0xc42011ec20, 0x20, 0x0, 0x0) /Users/philips/src/k8s.io/helm/cmd/helm/package.go:143 +0xa5 main.(*packageCmd).run(0xc420017720, 0xc420390240, 0xc420120d00, 0x1, 0x4, 0x13639b0, 0x104dfe0) /Users/philips/src/k8s.io/helm/cmd/helm/package.go:130 +0x31b main.newPackageCmd.func1(0xc420390240, 0xc420120d00, 0x1, 0x4, 0x0, 0x0) /Users/philips/src/k8s.io/helm/cmd/helm/package.go:77 +0xc4 k8s.io/helm/vendor/github.com/spf13/cobra.(*Command).execute(0xc420390240, 0xc420120c40, 0x4, 0x4, 0xc420390240, 0xc420120c40) /Users/philips/src/k8s.io/helm/vendor/github.com/spf13/cobra/command.go:571 +0x234 k8s.io/helm/vendor/github.com/spf13/cobra.(*Command).ExecuteC(0xc420405200, 0x0, 0x0, 0x0) /Users/philips/src/k8s.io/helm/vendor/github.com/spf13/cobra/command.go:661 +0x367 k8s.io/helm/vendor/github.com/spf13/cobra.(*Command).Execute(0xc420405200, 0x1b52720, 0xc4200001a0) /Users/philips/src/k8s.io/helm/vendor/github.com/spf13/cobra/command.go:620 +0x2b main.main() /Users/philips/src/k8s.io/helm/cmd/helm/helm.go:110 +0x2d ```	8 years ago
Matt Butcher	f1d07c3f11	feat(helm): add --verify flag to commands ... This adds the --verify and --keyring flags to: helm fetch helm inspect helm install helm upgrade Each of these commands can now make cryptographic verification a prerequisite for using a chart.	8 years ago
Matt Butcher	d80df93414	feat(helm): add signature support to 'helm package'	8 years ago
Matt Butcher	ce83a8a777	feat(pkg/provenance): add OpenPGP signatures ... This adds support for OpenPGP signatures containing provenance data. Such information can be used to verify the integrity of a Chart by testing that its file hash, metadata, and images are correct. This first PR does not contain all of the tooling necessary for end-to-end chart integrity. It contains just the library. See #983	8 years ago