The scope test configured a TLS registry while advertising an http token
realm. oras refuses to send credentials to an http token realm when the
registry itself was contacted over https, so the auth server was never
reached and the test timed out ("timeout waiting for auth request").
Use a plain-http registry so the registry and token-realm schemes match;
the scope carried in the token request is what this test verifies, and
that is independent of TLS.
Also make the auth handler's channel send non-blocking so that a client
retry can never block the handler and stall the push/pull flow, which
addresses the review comment about a potential deadlock.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
- Fix data race by using channel instead of shared variable for requestURL
- Make assertions more robust by parsing URL and checking query parameters instead of exact string matching
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
- Change 'bellow' to 'below' (spelling correction in multiple places)
- Change 'WithScopeHint' to 'withScopeHint' to match actual function name
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
- Change DockerRegistryHost to use 127.0.0.1 for HTTP tests and helm-test-registry for TLS tests to match certificate hostname
- Add defer ln.Close() to prevent resource leak in token auth server setup
- Restore requestURL variable and assertion in test body instead of handler to avoid potential race condition
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
Convert internal/urlutil, internal/cli/output, internal/monocular,
and internal/sympath test files from native Go testing patterns
(t.Errorf, t.Fatalf, t.Error, t.Fatal) to github.com/stretchr/testify
equivalents (assert.X, require.X).
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
Address the follow-up review on the previous revision:
- Add TestUpgradeReleaseRecordsChartSourceAfterRender, mirroring the install
regression test: it upgrades a release with a template that prints
.Chart.Annotations and asserts the recorded source is absent from the
rendered manifest but present on the persisted upgraded release. This guards
the upgrade path against a future refactor moving the annotation back before
rendering and reintroducing the render-context leak.
- Correct the Metadata.Annotations doc comment in 'helm get metadata': the map
is no longer solely from Chart.yaml; for releases recorded with a source it
also includes the meta.helm.sh/release-source annotation Helm adds at
install/upgrade time (also surfaced separately via Source).
Signed-off-by: Shaan Satsangi <shaansatsangi@gmail.com>
Previously the chart source was recorded by mutating the chart's metadata
annotations in pkg/cmd before calling RunWithContext. Because the render
values expose chart metadata to templates (.Chart comes from
accessor.MetadataAsMap()), this injected meta.helm.sh/release-source into
.Chart.Annotations during template rendering, which could change rendered
manifests for charts that enumerate or branch on chart annotations.
Move the annotation to the action layer and apply it only after rendering
completes, via a new Install.ChartSource / Upgrade.ChartSource field. The
annotation lands on the persisted release's chart metadata (the same chart
pointer stored on the release) but is never present in the template render
context, so 'helm list --show-source' and 'helm get metadata' still surface
the source while rendered output is unaffected.
The cmd helper is reduced to a pure chartSource() resolver (repo URL
preferred, credentials stripped); sanitizeChartSource is unchanged. Adds an
action-level test asserting the source is absent from the rendered manifest
but present on the stored release.
Signed-off-by: Shaan Satsangi <shaansatsangi@gmail.com>
The --show-source help claimed JSON/YAML output 'always includes' the
source field, but releaseElement.Source is tagged json:"source,omitempty"
so it is omitted when a release has no recorded source. Reword the help to
state the flag affects only table output and that JSON/YAML emit source
whenever a release has one.
Also add cmd-level get metadata coverage for a release whose chart records
meta.helm.sh/release-source, with table/JSON/YAML golden files, so the new
SOURCE line and source field do not regress.
Signed-off-by: Shaan Satsangi <shaansatsangi@gmail.com>
Replace native Go testing patterns (t.Errorf, t.Fatalf, t.Error,
t.Fatal) with github.com/stretchr/testify equivalents (assert.X,
require.X) for improved test readability and error messages.
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
url.Parse treats a Windows absolute path such as C:\charts\mychart as
having scheme "c", so sanitizeChartSource re-encoded it (e.g. the drive
letter was lowercased and separators could be percent-escaped), producing
a misleading SOURCE value for local installs/upgrades.
Gate sanitization on the parsed URL having a host component, so only real
repository URLs (scheme://host/...) are rewritten while local filesystem
paths and chart references are returned unchanged. Add regression tests
covering Windows (back- and forward-slash) and absolute unix paths.
Signed-off-by: Shaan Satsangi <shaansatsangi@gmail.com>
Replace native Go testing patterns (t.Errorf, t.Fatalf, t.Error,
t.Fatal) with github.com/stretchr/testify equivalents (assert.X,
require.X) for improved test readability and error messages.
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
Replace native Go testing patterns (t.Errorf, t.Fatalf, t.Error,
t.Fatal) with github.com/stretchr/testify equivalents (assert.X,
require.X) for improved test readability and error messages.
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
Convert internal/fileutil, internal/tlsutil, and internal/resolver
test files from native Go testing patterns (t.Errorf, t.Fatalf,
t.Error, t.Fatal) to github.com/stretchr/testify equivalents
(assert.X, require.X).
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
Replace native Go testing patterns (t.Errorf, t.Fatalf, t.Error,
t.Fatal) with github.com/stretchr/testify equivalents (assert.X,
require.X) for improved test readability and error messages.
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
Record where a release's chart was installed or upgraded from and surface
it via `helm list` and `helm get metadata` — addressing both surfaces
called out in #4256.
`helm install` and `helm upgrade` set a `meta.helm.sh/release-source`
annotation on the chart metadata (the `--repo` URL when supplied,
otherwise the chart reference). The annotation is written after any
`--dependency-update` chart reload so it survives the reload, and any
credentials embedded in a repo URL are stripped before the value is
persisted so secrets are not leaked into the release record.
- `helm list`: new `source` field in JSON/YAML output (omitted when
empty, so existing releases keep their schema) plus an opt-in
`--show-source` flag for the table column, leaving the default table
layout unchanged for scripts that parse it.
- `helm get metadata`: new `source` field, shown in the table only when
set.
Closes#4256
Signed-off-by: Shaan Satsangi <shaansatsangi@gmail.com>
kimsm28
Terry Howe
dependabot[bot]
George Jenkins
Will Noble
Will Noble
Shaan Satsangi
Matthieu MOREL