5 Commits (v3.21.4)

Author	SHA1	Message	Date
Karan V	ab71449c76	fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932 ... Backport of the openpgp migration already merged to main (7c9176ae3) to dev-v3. golang.org/x/crypto/openpgp is frozen and flagged by govulncheck as GO-2026-5932 with no fixed release, leaving the govulncheck check red on every Go PR targeting dev-v3. Replace it with the maintained drop-in fork github.com/ProtonMail/go-crypto in pkg/provenance, the only consumer on this branch. The only API difference is openpgp.CheckDetachedSignature, which now takes an io.Reader and a *packet.Config. Pin the indirect github.com/cloudflare/circl at v1.6.3, as v1.6.2 pulled in by default is itself flagged (GO-2026-4550, fixed in v1.6.3). Also backport the mixed RSA/ed25519 keyring sign/verify regression test from main, adapted to the v3 Signatory API, since keyrings with modern key algorithms are the main behavioral surface of this swap. govulncheck ./... now reports 0 vulnerabilities. Fixes #32361 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Karan V <karanvknarayanan@gmail.com> (cherry picked from commit bd392c6a60)	2 days ago
Adam Reese	e458a67f0c	ref(pkg/chart): add validation method to chart ... Consolidate validation of Chart.yaml. Signed-off-by: Adam Reese <adam@reese.io>	7 years ago
Adam Reese	0c6b6d1c62	fix(*): correct file permissions on source files	10 years ago
Matt Butcher	9ae97c341c	fix(helm): read passphrase from prompt ... This prompts the user to enter a passphrase if the given PGP key is encrypted. Closes #1447	10 years ago
Matt Butcher	ce83a8a777	feat(pkg/provenance): add OpenPGP signatures ... This adds support for OpenPGP signatures containing provenance data. Such information can be used to verify the integrity of a Chart by testing that its file hash, metadata, and images are correct. This first PR does not contain all of the tooling necessary for end-to-end chart integrity. It contains just the library. See #983	10 years ago