A descriptor's declaration decides nothing on its own. An entry may list
manifests rather than hold an artifact, which a multi-arch image beside a
chart does, and it may declare an artifact type that is not the chart's,
which a builder setting the field wrongly leaves behind. Ruling on either
from the descriptor loses charts that are there: the list is never searched,
or the entry is dropped before its config is read, and in both cases the
chart beside it becomes the only one in the index and answers in its place.
Search what an entry lists, the same way the top index is searched, whether
it carries the OCI index media type or the Docker manifest list one, and
read the config of every entry whose declaration did not match, not only of
those that declared nothing. A list is still never a candidate: the artifact
is identified by the config blob its manifest carries and a list has none,
so taking one would root the copy at a manifest the filter drops. Both
readings happen under the condition that already governs the second pass, so
an index whose declared entries answer the reference is resolved without
either.
Reading an entry means reading what a registry serves for it, so the reading
is bounded twice over. An entry declaring more bytes than a manifest is goes
unread, and so does one whose body holds neither the config nor the list of
manifests its media type promised, since a body that parses as both shapes
proves nothing about either. The search itself stops three lists down,
counting from the one the reference resolves to, against a chain a registry
is free to extend while it is walked.
None of those three is dropped quietly. Each is recorded the way an entry
that cannot be fetched is, because every answer resting on nothing else in
the index matching has to know the difference between an index that holds
one chart and a pass that read one.
A manifest the copy will not store cannot be the answer either. A chart
written to the Docker schema, which is what a registry-to-registry copy
leaves behind, is copied like the OCI one it describes, and a selection
that lands on anything else the pull does not accept says so and names
the entry, rather than leaving a copy that quietly stores nothing and a
message about descriptors that never arrived.
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Assisted-By: Claude <noreply@anthropic.com>
Pulling a reference that resolves to an Image Index collected every
descriptor matching a fixed media-type allow-list, then assigned the
config, chart and provenance descriptors with a switch that kept the
last match of each kind. That slice is filled from oras PreCopy
callbacks during a concurrent graph walk, so its order is neither the
order of the index nor defined by anything else, and each kind is
resolved independently of the others. For an index holding more than
one chart the delivered chart is arbitrary, and because the metadata
is read from the config blob while the bytes come from the chart
layer, the two can describe different charts. Nothing on the path
compares them, and the file name is taken from the reference rather
than from either.
Select the chart manifest before copying instead. An entry declaring
the chart artifactType is a candidate, whether or not it also carries
a platform, so that tooling stamping a platform on every index entry
cannot hide the chart. Entries declaring no type are matched on their
config mediaType, which keeps an index written before artifactType
existed resolvable. That second pass runs when the first found
nothing, and also when no single entry it found announces the whole
requested name and version, since narrowing the candidates before
that is checked is how a mixed index answers with the wrong chart.
Asking per attribute instead would let one entry supply the name and
another the version, and the pair they form belongs to neither.
Several candidates are then narrowed by the requested name and, if
that leaves more than one, by the requested version. Both are read
from the descriptor annotations, falling back to the candidate's own
config for whichever an index omits. Entries repeated in the index
are collapsed first, so one chart is never called ambiguous with
itself, and an answer that rests on nothing else matching is withheld
when the pass could not read every entry, because absence is a fact
about the index only while the whole index could be read. Reading a
candidate's identity can fail the same way and now says so, so a
chart whose name could not be fetched is no longer indistinguishable
from a chart that is not there. A choice that name and version cannot
settle is an error naming the candidates rather than an arbitrary
pick.
One consequence worth naming. Pulling an index reference reports the
digest of the selected chart manifest where it previously reported
the digest of the index. Selection runs inside the copy, on the root
oras has already resolved, so narrowing an index costs no request of
its own. The pass over the entries that declare no type is what costs
requests, one per entry, and only when it runs.
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Assisted-By: Claude <noreply@anthropic.com>
* fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158
govulncheck on main flags GO-2026-5158 in go.opentelemetry.io/otel@v1.43.0
(fixed in v1.44.0). Bump the transitive otel dependency to clear the
vulnerability.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
* fix: bump otel/sdk and otel/sdk/metric to v1.44.0 for version parity
Keep the lockstep-versioned OpenTelemetry core and SDK modules aligned at
v1.44.0 to avoid version skew.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---------
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
TestInstallRelease_Wait_Interrupted and
TestInstallRelease_RollbackOnFailure_Interrupted assert that the detached
installation goroutine has exited by sleeping a fixed 10s -- exactly the
FailingKubeClient WaitDuration the goroutine blocks on. Sleeping the same
duration the goroutine takes is a zero-margin race: if the goroutine
finishes a hair after the fixed sleep elapses (scheduler jitter under load),
getGoroutineCount() has not decremented yet and the assertion flakes.
Replace the fixed sleep + point-in-time assert with is.Eventually polling
getGoroutineCount() (30s ceiling, 10ms tick). It returns as soon as the
goroutine has actually finished and no longer races the exact wait
duration. Test-only; no change to install behavior.
Signed-off-by: Nikolaus Schuetz <nikolauspschuetz@gmail.com>
If the CLI-side description validation is removed, the unicode/utf8 import becomes unused and should also be dropped.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
Move description length validation to the beginning of Run(), before
IsReachable(), so programmatic callers get an immediate validation
error instead of a potentially misleading cluster reachability failure.
Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
Remove duplicate rollback-with-description.txt fixture that had
identical content to rollback.txt.
Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
Add a new --description flag to the helm rollback command that allows
users to specify a custom description explaining why the rollback was
performed. This description is stored in the release metadata.
Changes:
- Add Description field to the Rollback action struct
- Add --description flag to the rollback CLI command
- Add 512 character limit validation for the description
- Default to 'Rollback to <version>' when no description is provided
The description flag is optional and follows the same pattern used by
the install and upgrade commands.
Closes #XXXX
Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
Aleksei Sviridkin
dependabot[bot]
Terry Howe
George Jenkins
MrJack
Nikolaus Schuetz
Solomon Wakhungu
Matthieu MOREL