* Add GPG signature verification to install script
The script fetches the KEYS file from GitHub, as well
as the .asc files on the release and verifies the
release artifacts are signed by a valid key.
Added new boolean config options in the install script
which allow for fine-grained control over verification
and output:
- DEBUG: sets -x in the bash script (default: false)
- VERIFY_CHECKSUM: verifies checksum (default: true)
- VERIFY_SIGNATURE: verifies signature (default: true)
Also reduced check for curl/wget to only one time.
Resolves#7943.
Resolves#7838.
Signed-off-by: Josh Dolitsky <393494+jdolitsky@users.noreply.github.com>
* disable signature verification by default
Signed-off-by: Josh Dolitsky <393494+jdolitsky@users.noreply.github.com>
* remove repeated line
Signed-off-by: Josh Dolitsky <393494+jdolitsky@users.noreply.github.com>
* fix typo
Signed-off-by: Josh Dolitsky <393494+jdolitsky@users.noreply.github.com>
* do not auto-import GPG keys
Signed-off-by: Josh Dolitsky <393494+jdolitsky@users.noreply.github.com>
* silence errors about missing commands
Signed-off-by: Josh Dolitsky <393494+jdolitsky@users.noreply.github.com>
* use a temporary gpg keyring
Signed-off-by: Josh Dolitsky <393494+jdolitsky@users.noreply.github.com>
* Fix wget commands for VERIFY_SIGNATURES=true
Signed-off-by: jdolitsky <393494+jdolitsky@users.noreply.github.com>
This file was previously used for shell completions but is
no longer in use as there is a new completions system in place
and there has been for some time.
The contents of this file were out of date and reflect Helm v2.
Closes#8186
Signed-off-by: Matt Farina <matt@mattfarina.com>
When installing Helm, the following warning gets printed on the console:
Downloading https://get.helm.sh/helm-v2.16.6-linux-amd64.tar.gz
Preparing to install helm and tiller into /usr/local/bin
helm installed into /usr/local/bin/helm
tiller installed into /usr/local/bin/tiller
main: line 178: which: command not found
Run 'helm init' to configure helm.
The 'which' command is optional, and not always installed on all
environments (like a Fedora container). Instead, use 'command -v' to
detect if the executable is in the $PATH.
Signed-off-by: Niels de Vos <ndevos@redhat.com>
A recent change to the get scripts causes them to pickup
pre-releases in addition to stable releases. This update causes
only stable releases to be fetched by the get scripts.
Fixed#7941
Signed-off-by: Matt Farina <matt@mattfarina.com>
* Make get script eaiser for helm versions to live side by side (helm3 etc)
Signed-off-by: Scott Rigby <scott@r6by.com>
* Change PROJECT_NAME to BINARY_NAME for purpose clarity
Signed-off-by: Scott Rigby <scott@r6by.com>
The mapfile command is not available on a standard MacOS install.
To faciliate doing `make test` which runs validate-license.sh,
let's use an array instead of mapfile.
Signed-off-by: Marc Khouzam <marc.khouzam@montreal.ca>
This is a temporary fix. This prevents the get script from installing Helm 3 as soon as it's released, potentially causing disruption to users that were expecting a Helm 2 release.
A `get-helm-3` script is also supplied, which is identical to the previous `get` script. That way, Helm 3 users also have an equivalent way to install Helm 3.
Signed-off-by: Matthew Fisher <matt.fisher@microsoft.com>
* Drop dependency on k8s.io/kubernetes
https://github.com/helm/helm/issues/6606
Depending on k8s.io/kubernetes is not recommended by Kubernetes, and
forces dependencies of Helm to also depend on them. We are only using
this dependency in one relatively isolated occurance, which can be
easily copied over rather than depending on the entire Kubernetes.
Copying this code is not very desirable, so if we don't want to have
this duplication we can at least use this PR as a PoC and see if we can
get Kubernetes to publish the controller package as a separate Go module
(see
https://github.com/kubernetes/kubernetes/issues/79384#issuecomment-538740756)
Signed-off-by: John Howard <howardjohn@google.com>
* Move to internal
Signed-off-by: John Howard <howardjohn@google.com>
* Exclude third_party from validate-license.sh
Signed-off-by: John Howard <howardjohn@google.com>
The stable repository provides a quick onboarding with a set of
community curated charts. Two problems with the community stable
repository has lead to its need to be removed.
1. The URL is hard coded to a Google Cloud bucket under Google's
control. This was setup when Helm was part of Kubernetes and
Kubernetes was a Google project. The bucket cannot be
transfered to another non-Google controlled project. And,
the bucket is not accessible in some parts of the world
(e.g., China).
2. The number of charts in the stable repository has grown
generally unmaintainable. The repository maintainers cannot
manage the number of PRs coming it cauing delays in response
or no response and PRs are automatically closed. This is
a poor experience.
The alternatice is the Helm Hub that provides a central point of
search for many Helm repositories. Different people and organizations
can maintain their own charts. A central server is not needed as
Helm is setup to be distributed.
Signed-off-by: Matt Farina <matt@mattfarina.com>
To match the convention of `helm install`, `helm uninstall` is the inverse.
Other tangential changes in this PR:
- StatusDeleting has been changed to StatusUninstalling
- StatusDeleted has been changed to StatusUninstalled
- `helm list --deleted` has been changed to `helm list --uninstalled`
- `helm list --deleting` has been changed to `helm list --uninstalling`
- `helm.DeleteOption` and all delete options have been renamed to `helm.UninstallOption`
I have not made any changes to the "helm.sh/hook-delete-policy", "pre-delete" and "post-delete" hook annotations because
1. it's a major breaking change to existing helm charts, which we've commited to NOT break in Helm 3
2. there is no "helm.sh/hook-install-policy" to pair with "helm.sh/hook-uninstall-policy", so delete still makes sense here
`helm delete` and `helm del` have been added as aliases to `helm uninstall`, so `helm delete` and `helm del` still works as is.
Instead of presuming that bash is installed at /bin/bash, use `$PATH`. Official [bash docker container](https://hub.docker.com/_/bash/) installs bash at `/usr/local/bin` and recommends the use of `env`
Scott Rigby
Josh Dolitsky
Ma Xinjian
Matthew Fisher
vitt-bagal
Matt Farina
Niels de Vos
Bridget Kromhout
Paul Czarkowski
Marc Khouzam
John Howard
Martin Hickey
Adam Reese
roc
ReSearchITEng
Ferenc-
Arturo Contreras
Michal Zerola
Adam Reese
Justin Scott
Tim H