containerd v1 is EOL and will never receive fixes for
GO-2026-5622, GO-2026-5338, GO-2026-5064. The only import
was for `remotes.Resolver` in the deprecated `ClientOptResolver`
stub. Changing its parameter type to `any` preserves the public
API while removing the vulnerable dependency entirely.
It should help for PR like https://github.com/helm/helm/pull/32297
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
oras-go v2.6.1 hardens the auth client to drop the Authorization header
when a request's origin changes mid-flight (GHSA-vh4v-2xq2-g5cg). Helm's
fallbackTransport reaches plain-HTTP registries by downgrading the
connection from https to http inside a single round trip, which oras now
treats as a credential-leaking origin change and refuses to authenticate.
On login, detect when the transport has fallen back to plain HTTP and, in
that case, set PlainHTTP explicitly and re-ping so requests are built as
http from the start. The scheme no longer changes mid-request, credentials
flow as before, and the new cross-origin protection is preserved for real
https registries (forcedHTTP stays false, so the retry never triggers).
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
In the move to oras v2, an existing but empty registry config file
became an uncaught error. A missing file caused no error. This
change catches the error and works around it so that Helm can
continue to be fault tolerant to this issue.
Signed-off-by: Matt Farina <matt.farina@suse.com>
- The newReference() function transforms version tags by replacing + with _ for OCI compatibility
- But the code was using the original ref (with +) for TagBytes()
- Then it tries to find the tagged reference using parsedRef.String() (with _)
- This mismatch causes the Resolve method to fail with "not found"
- By using parsedRef.String() consistently in both places, the references will match and the lookup will succeed.
I extracted the TagBytes function to improve testability.
Push() includes several external calls that are hard to mock,
so isolating this logic makes testing more manageable.
Close: #30881
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
Helm 3.18.0 released an upgrade of ORAS from v1 to v2.
ORAS v2 correctly does not accept http/https scheme for registry login, while
ORAS v1 previously did. Even if v1 should not have, we want to preserve
backwards compatibility for Helm 3 users who pass the scheme.
This will be removed in Helm 4, where registry login will not accept http/https
scheme.
Co-authored-by: Andrew Block <andy.block@gmail.com>
Co-authored-by: Terry Howe <terrylhowe@gmail.com>
Signed-off-by: Scott Rigby <scott@r6by.com>
Fixes: #12584
This change makes the authorizer and registryAuthorizer of the registry client configurable via options. This allows Go SDK users to override the authentication behavior of the client.
This PR makes both the authorizer and registryAuthorizer configurable because depending on the exact scenario that may be needed. The default registryAuthorizer only supports a specific implementation of the authorizer.
Signed-off-by: Ryan Nowak <nowakra@gmail.com>
When username/password parameters are passed in via the CLI
they are not passed down to the client handling requests to
OCI registries. This change ensures this happens
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
This reverts commit 4a27baaffc.
Note, PR #11129 was layered in along with this change so the revert
preserves this API addition.
Signed-off-by: Matt Farina <matt.farina@suse.com>
The assumption that either a username and/or password OR an error is
returned appears to be wrong, and results in an error later on which
looks something like the following:
```
failed to authorize: failed to fetch anonymous token: unexpected status
from GET request to https://auth.docker.io/token?scope=repository%3AXXX%2FYYY%3Apull&service=registry.docker.io:
401 Unauthorized
```
To mitigate this, confirm we actually have one of the values before
setting the `Authorization` header.
Co-authored-by: Joe Julian <me@joejulian.name>
Signed-off-by: Hidde Beydals <hidde@hhh.computer>
Add a new flag `--plain-http` to the following commands:
* `helm install`
* `helm pull`
* `helm push`
* `helm template`
* `helm upgrade`
* `helm show`
This flag instructs the registry client to use plain HTTP connections,
thus enabling upload/download of charts from OCI registries served at
an HTTP endpoint.
Signed-off-by: Sanskar Jaiswal <jaiswalsanskar078@gmail.com>
kimsungmin1
Benoit Tigeot
Benoit Tigeot
Terry Howe
Pedro Tôrres
George Jenkins
Scott Rigby
Matheus Pimenta
Evans Mungai
Eric Stroczynski
Matt Farina
Brandt Keller
Brandt Keller
Ryan Nowak
Andrew Block
Robert Sirchia
Matt Farina
Hidde Beydals
Antonio Gamez Diaz
Joe Julian
cuisongliu
Sanskar Jaiswal