Sprig's toPrettyJson uses json.MarshalIndent which HTML-escapes &, <, >
to \u0026, \u003c, \u003e. This breaks URLs and other strings containing
these characters when used in Helm chart templates.
* fix(engine): introduce toPrettyRawJson instead of overriding toPrettyJson
Per maintainer review, do not override Sprig's toPrettyJson/mustToPrettyJson
(which HTML-escape &, <, >), since existing charts may rely on the escaped
output. Instead add new toPrettyRawJson/mustToPrettyRawJson functions that
produce indented JSON with HTML characters unescaped — the indented
counterpart to Sprig's toRawJson — preserving backwards compatibility.
Add a regression test asserting toPrettyJson still escapes HTML.
* fix(engine): gofmt alignment in funcMap
* fix(engine): resolve leftover merge conflict in funcs_test.go
The merge of main left unresolved conflict markers in the mustFuncsTests
table. Keep main's brace and indentation style for the slice literal, and
re-apply the toPrettyRawJson/mustToPrettyRawJson cases on top of it.
Signed-off-by: piotr.laczykowski <piotr.laczykowski@example.com>
Dependabot bumps that pull in a dependency requiring Go 1.27 (#32786,
#32755) raise the go directive in go.mod, which in turn activates the
modernize analyzer's embedlit and stringscut checks. Those checks then
fire on pre-existing code and fail golangci-lint, so every such bump is
blocked on a cleanup it does not own.
Do the cleanup once, here, together with the directive bump that makes
it legal: neither fix compiles at go 1.26.0 (promoted-field keys in
composite literals and strings.CutLast are both Go 1.27).
Changes are the modernize autofix, reviewed:
- embedlit: drop the embedded field type from struct literals, mostly
ObjectMeta/TypeMeta in tests, plus a few in production code.
- stringscut: parseTemplateSimpleErrorString now uses strings.CutLast
instead of strings.LastIndex with manual slicing.
CI already builds with Go 1.27 (GOLANG_VERSION in .github/env), so this
only aligns the module's declared language version with the toolchain.
Signed-off-by: Terry Howe <thowe@nvidia.com>
NewTransport cloned http.DefaultTransport only when that held an
*http.Transport, and otherwise returned the shared value as is. A
RoundTripper installed by an imported package cannot be cloned, and
ensureTLSConfig cannot apply Helm's TLS settings to it either, so the
TLS options of a registry client silently had nowhere to go and
registry login panicked on the resulting error.
Return a transport built from the standard library defaults in that
case, and log that the replacement is not used, so the transport a
client gets is always one Helm owns and can configure.
Signed-off-by: yuwk <1729065730@qq.com>
`helm list --help` said --max 0 returns "the server's default". The
action only truncates when Limit > 0 (pkg/action/list.go:216), so 0 or a
negative value returns every release.
The root help listed HELM_COLOR as "(default: never)"; envColorMode()
in pkg/cli/environment.go falls back to "auto", which --color also
reports as its default.
Signed-off-by: ZainnQureshii <43629888+ZainnQureshii@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feature: automated OCI end-to-end tests
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
* test: address review feedback on OCI e2e tests
Move the OCI end-to-end tests out of package cmd into a dedicated
test/e2e package behind an 'e2e' build tag, and drive a real helm binary
rather than executeActionCommand.
- Parameterize the registry, namespace, and credentials so the tests run
against any OCI registry, not a hard-coded personal GHCR namespace.
- Isolate each run's repositories and namespace with a random run ID.
- Fail rather than skip when required configuration is missing, since the
build tag is already an explicit opt-in.
- Pass the registry password over stdin so credentials never reach argv
or test output.
- Assert an authentication-specific failure in the invalid credential
test instead of accepting any error.
- Install through a real helm binary against the ambient kubecontext, so
the Kubernetes test no longer runs against the fake kube client.
- Stop dereferencing the os.Stat result after a stat error.
- Add a 'make test-e2e' target and test/e2e/README.md.
Signed-off-by: Terry Howe <thowe@nvidia.com>
* test: address second round of review feedback on OCI e2e tests
- Verify pulled chart contents against the source fixture instead of only
checking that a path of the expected name exists, so a registry serving a
different artifact under the same tag fails the test.
- Skip the invalid-credential test against a registry that serves anonymous
access, where there is no authentication to exercise.
- Delete the namespace the Kubernetes test creates, and wait for it to go,
so runs do not accumulate namespaces. A caller-supplied
HELM_E2E_NAMESPACE is left in place.
Signed-off-by: Terry Howe <thowe@nvidia.com>
* test: run OCI e2e tests across registry implementations
The suite has no registry-specific behavior, so covering a new registry
is a matter of pointing it at one. Add the CI wiring to do that, and make
the repository paths suitable for shared registries.
- Repository paths are now stable rather than per-run. The fixtures are
immutable, so re-running overwrites each tag with identical content.
This bounds the repositories a shared registry accumulates and lets
registries that require repositories to exist before a push (ECR) have
them created ahead of time. HELM_E2E_ISOLATE restores per-run paths.
- Add HELM_E2E_REPO to set the repository path under the registry.
- Add e2e.yml: local authenticated registry plus kind, no secrets, so it
runs on pull requests from forks.
- Add e2e-registries.yml: nightly matrix over GHCR, Quay, and ECR with
fail-fast disabled. A registry with no secrets configured is skipped,
so they can be wired up one at a time.
Signed-off-by: Terry Howe <thowe@nvidia.com>
* test: address review feedback on e2e harness and workflow
- Build the helm binary by relative package path instead of the v4 module
path, so the harness also works on branches where the module carries a
different major version suffix.
- Scope Kubernetes release names to the run. A caller-supplied
HELM_E2E_NAMESPACE may already hold releases, and a fixed name could
collide with one that cleanup would then uninstall.
- Fail a partially configured registry leg in the nightly workflow
instead of reporting it as configured and failing later in the harness
or the AWS CLI. A leg with no registry set is still skipped.
Signed-off-by: Terry Howe <thowe@nvidia.com>
* test: honor HELM_KUBECONTEXT when deleting the e2e namespace
Helm subprocesses inherit HELM_KUBECONTEXT from the environment, but the
cleanup client loaded the kubeconfig's current-context. When the two
differ, releases are installed into one cluster while the namespace
delete is sent to another, where it returns NotFound and is treated as
success, leaking the namespace it was meant to remove.
Apply the same context override when building the cleanup client.
Signed-off-by: Terry Howe <thowe@nvidia.com>
* test: build e2e cleanup client from helm's own settings
Overriding only HELM_KUBECONTEXT still left the cleanup client able to
diverge from the helm subprocesses, which also honor HELM_KUBEAPISERVER,
HELM_KUBETOKEN, HELM_KUBECAFILE, HELM_KUBETLS_SERVER_NAME and
HELM_KUBEINSECURE_SKIP_TLS_VERIFY. Any of those could send the namespace
delete to a different endpoint, where NotFound reads as success and the
namespace leaks.
Resolve the client through cli.New().RESTClientGetter() instead, so it is
built exactly the way the subprocesses build theirs and stays in step
without mirroring each variable by hand.
Signed-off-by: Terry Howe <thowe@nvidia.com>
* test: run hosted e2e against docker hub in single-repository mode
Replace the GHCR, Quay and ECR legs of e2e-registries with a Docker Hub
job using the E2E_DOCKER_* secrets. Docker Hub does not nest repository
paths and a scoped token can only write to one repository, so add
HELM_E2E_SINGLE_REPO: each fixture is repackaged under that repository's
name with its own prerelease version, e.g. 0.1.0-unicode-chart.
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
* ci: read non-secret docker hub e2e settings from repository variables
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
* ci: run e2e workflow on main only
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
* ci: update kind, registry, httpd, checkout and setup-go in e2e workflows
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
* ci: serialize e2e-registries runs that share docker hub tags
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---------
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
Signed-off-by: Terry Howe <thowe@nvidia.com>
* fix(action): wait for CRD establishment under HookOnlyStrategy
Motivation:
installCRDs() selected its CRD-establishment waiter using the
release's WaitStrategy. Under kube.HookOnlyStrategy, that waiter's
Wait() is a no-op by design, intended to skip waiting on general
chart resources such as Deployments. That no-op also silently
skipped the unrelated CRD establishment check, which exists so
custom resources depending on freshly-installed CRDs aren't
processed before the API server recognizes the new CRD types. Helm 3
performed this CRD establishment wait unconditionally, regardless of
the release's wait flag/strategy. Under HookOnlyStrategy this can
intermittently produce an install failure such as:
no matches for kind "ServiceMonitor" in version "monitoring.coreos.com/v1"
when a chart installs CRDs and dependent custom resources in the
same release, if the CRDs have not finished being established by the
time Helm processes the custom resources.
Approach:
In installCRDs(), compute a local crdWaitStrategy that substitutes
kube.StatusWatcherStrategy for the CRD-establishment wait only when
i.WaitStrategy is HookOnlyStrategy. i.WaitStrategy itself is left
untouched, so every other waiter-selection call site (the
general-resource wait later in Install.RunWithContext, and the
equivalents in rollback.go/upgrade.go) keeps HookOnlyStrategy's
existing no-op behavior for general resources. This mirrors the
promotion to StatusWatcherStrategy already used elsewhere in this
file for HookOnlyStrategy combined with RollbackOnFailure.
Validation:
- go build ./...
- go test ./pkg/action/... ./pkg/kube/...
- golangci-lint run ./pkg/action/... ./pkg/kube/... (0 issues)
- go vet ./pkg/action/... ./pkg/kube/... (clean)
- go mod tidy -diff (empty)
- make build && make test-coverage PKG="./pkg/action/... ./pkg/kube/..."
- Added TestInstallCRDs_HookOnlyStrategyStillWaitsForEstablishment, a
targeted unit test with a fake kube.Interface that mimics the real
no-op hookOnlyWaiter versus a genuine wait attempt. Verified via
git stash that this test fails on the pre-fix code ("An error is
expected but got nil") and passes after the fix.
This was validated at the unit level with a fake Kubernetes client,
not against a live cluster.
Report: https://github.com/helm/helm/issues/32671
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Assisted-by: claude-sonnet-5 (via Claude Code)
* test(action): reuse FailingKubeClient for the CRD wait strategy test
Drop the test-only strategyAwareWaitKubeClient/strategyAwareWaiter fakes
and use kubefake.FailingKubeClient instead. FailingKubeClient now records
the WaitStrategy passed to GetWaiter/GetWaiterWithOptions in
RecordedWaitStrategies, alongside the existing RecordedWaitOptions, so the
test can assert installCRDs() asks for a StatusWatcherStrategy waiter
under HookOnlyStrategy.
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Assisted-by: claude-opus-5-5 (via Claude Code)
---------
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
In (*Client).Login(), credentials.ServerAddressFromHostname(key) was
originally added in commit 6ab7aa361 as a workaround for oras-go v2.6.0
where ServerAddressFromRegistry("registry-1.docker.io") did not return
the canonical https://index.docker.io/v1/.
Since oras-go was bumped to v2.6.2 (which incorporates oras-project/oras-go#966),
ServerAddressFromRegistry already normalizes both "docker.io" and
"registry-1.docker.io" properly, making this second call redundant.
Closes#32681
Signed-off-by: abdouladieng <diengabdoulaziz110@gmail.com>
* feat(storage): add internal/storage/driver for release v2
Copy of pkg/storage/driver operating on internal/release/v2, with the
storage object Type field set to helm.sh/release.v2. The
sh.helm.release.v1 name prefix is unchanged.
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
* feat(storage): mark configmap release schema with a label
ConfigMaps have no Type field to record it in, unlike Secrets. Absence
of the label means v1. Also documents why the sh.helm.release.v1 name
prefix is decoupled from Type.
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
* Update internal/storage/driver/sql.go
Co-authored-by: Terry Howe <terrylhowe@gmail.com>
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
* Update test
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
* PR comment fixes
- Add comment to explain sql driver update behaviour when it comes to updating custom labels
- Apply custom labels in memory driver
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
* Update internal/storage/driver/records.go
Co-authored-by: Terry Howe <terrylhowe@gmail.com>
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
---------
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
Co-authored-by: Terry Howe <terrylhowe@gmail.com>
The string returned by the string builder was cast to a byte slice
anyways. Remove this indirection. Also, write directly to the buffer
instead of using fmt.Fprintln(...).
Signed-off-by: Tom Wieczorek <twieczorek@mirantis.com>
* fix: route registry messages to stderr in template and show
When pulling an OCI chart, the registry client prints "Pulled: ..." and
"Digest: ..." status lines (and deprecation/underscore warnings) to its
configured output writer. Since v4.2.1 (introduced by #32056), these
messages leaked into the stdout output of helm template and helm show,
breaking downstream consumers such as cdk8s and other YAML parsers.
Fix by passing the command's stderr to the registry client in the
template and show commands instead of stdout. This keeps stdout clean
for machine-readable YAML while still surfacing registry warnings and
status messages on stderr for troubleshooting, rather than discarding
them. The pull/push commands continue to print these messages on their
normal output writer.
The show command's addRegistryClient writer parameter is renamed to
registryOut and wired through to the registry client, so it is no longer
a no-op.
Fixes#32215
Signed-off-by: amarkdotdev <amarkdotdev@users.noreply.github.com>
* test(cmd): cover registry client stderr routing via OCI pull
Exercise helm template and helm show against an in-process OCI registry
(repotest.NewOCIServer) and assert Pulled:/Digest: status lines appear
on stderr only, keeping stdout free of registry noise.
Signed-off-by: amarkdotdev <amarkdotdev@users.noreply.github.com>
* test(cmd): drop weak addRegistryClient unit test
OCI pull coverage already asserts Pulled/Digest land on stderr, not stdout.
Signed-off-by: amarkdotdev <amarkdotdev@users.noreply.github.com>
---------
Signed-off-by: amarkdotdev <amarkdotdev@users.noreply.github.com>
Co-authored-by: amarkdotdev <amarkdotdev@users.noreply.github.com>
* refactor: remove per-file decompression size limit
Remove MaxDecompressedFileSize as it's no longer necessary after
migrating to a maintained JSON schema library (santhosh-tekuri/jsonschema/v6).
The original limit was added to protect against vulnerabilities in an
unmaintained library.
The total decompressed chart size limit (MaxDecompressedChartSize) remains
to protect against other attack vectors.
Partially resolves#30738
Related:
- https://github.com/helm/helm/pull/30743
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* fix: deprecate MaxDecompressedFileSize instead of removing
As Matt suggested we should keep the variable until v5 as it can be used
because it is public.
Related:
- https://github.com/helm/helm/pull/31748#discussion_r2738518696
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* fix: enforce aggregate size budget on directory loading
Directory-based chart loading (`LoadDir`) used unbounded `os.ReadFile`
calls with no total size check. Archive loading already enforces
`MaxDecompressedChartSize` via a remaining-byte budget but directory
loading did not, leaving local charts and `file://` dependencies as
an unbounded memory path.
Add `ReadFileWithBudget` in the archive package and use it in both
v2 and v3 directory loaders so they track the same aggregate budget.
Ref: https://github.com/helm/helm/pull/31748#issuecomment-4138927643
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* fix: cap directory budget reads with LimitReader
Use `os.Open` + `io.LimitReader` instead of `os.ReadFile` in
`ReadFileWithBudget` so a file that grows between stat and read
cannot allocate unbounded memory.
Also fix `MaxDecompressedFileSize` doc comment to reflect it is
unused/deprecated, add nil guard on remaining, and check
`os.Stat` errors in tests.
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* test: add v3 directory loader budget test
Mirror the v2 `TestLoadDirExceedsBudget` test for the v3 loader
to prevent budget enforcement regressions in either path.
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* refactor(loader): make read budget configurable
Follow recommendations from https://github.com/helm/helm/pull/31748#discussion_r3058581419
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* fix(loader): export BudgetedReader for cross-package use
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* fix(loader): rename max param to avoid shadowing built-in
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
---------
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
This is needed for goreleaser to create updates. Its latest release
needs it.
Updates needed for linting and to fix failed tests resulting from
Go std library changes.
Signed-off-by: Matt Farina <matt.farina@suse.com>
* fix(provenance): support GnuPG keybox (pubring.kbx) keyrings
Starting with GnuPG 2.1, file-backed public keyrings can use
~/.gnupg/pubring.kbx instead of the legacy pubring.gpg. Helm only read
the legacy format, so chart and plugin verification failed on
installations using the file-backed keybox.
Make the keyring loader format-aware:
- GnuPG keybox (pubring.kbx): extract OpenPGP keyblocks from the
keybox container without adding a dependency. Skip ephemeral blobs,
matching GnuPG's own read behavior.
- ASCII-armored keyrings: load single or concatenated exports.
- Legacy binary packet streams (pubring.gpg): retain the existing path.
defaultKeyring() falls back to pubring.kbx when pubring.gpg is absent.
pubring.gpg keeps precedence when both files exist.
This change covers file-backed public keyrings. It does not read the
SQLite database used by keyboxd, which needs a separate design.
Related to #31836
Signed-off-by: Ruslan Shaydullin <shaydullin.r.d@outlook.com>
* fix(provenance): treat only not-exist as keyring absence in defaultKeyring
A stat error other than 'not exist' (e.g. a permission problem) meant
the file may well be present, but defaultKeyring() skipped past it: an
unreadable pubring.gpg silently lost precedence to pubring.kbx, and the
surfaced error could point at the wrong file. Treat only fs.ErrNotExist
as absence. For any other stat error, return that path unchanged so the
real error surfaces when the keyring is opened.
Signed-off-by: Ruslan Shaydullin <shaydullin.r.d@outlook.com>
---------
Signed-off-by: Ruslan Shaydullin <shaydullin.r.d@outlook.com>
Co-authored-by: George Jenkins <gvjenkins@gmail.com>
YAMLReader can return EOF without yielding the last line when that line
has no trailing newline and its length is a multiple of bufio's default
buffer. Read the file fully and ensure a trailing newline before parsing
so compact JSON values files are not silently ignored.
Fixes#32506
Signed-off-by: Dean Chen <862469039@qq.com>
TestInstallRelease_Wait_Interrupted and
TestInstallRelease_RollbackOnFailure_Interrupted assert that the detached
installation goroutine has exited by sleeping a fixed 10s -- exactly the
FailingKubeClient WaitDuration the goroutine blocks on. Sleeping the same
duration the goroutine takes is a zero-margin race: if the goroutine
finishes a hair after the fixed sleep elapses (scheduler jitter under load),
getGoroutineCount() has not decremented yet and the assertion flakes.
Replace the fixed sleep + point-in-time assert with is.Eventually polling
getGoroutineCount() (30s ceiling, 10ms tick). It returns as soon as the
goroutine has actually finished and no longer races the exact wait
duration. Test-only; no change to install behavior.
Signed-off-by: Nikolaus Schuetz <nikolauspschuetz@gmail.com>
- Replace `err == io.EOF` with `errors.Is(err, io.EOF)` (errorlint).
- Match Chart.lock by full tar path ("chart-with-lock/Chart.lock")
instead of path.Base to avoid false positives from subchart lock files.
- Break out of the loop after finding the entry (early exit).
Signed-off-by: Ilya Kiselev <kis-ilya-a@yandex.ru>
Closes#32396.
StampModTimes now normalizes the supplied time to UTC and truncates to
whole seconds before stamping. Without this, an SDK caller passing a
local-timezone or sub-second time.Time would produce a Chart.lock
generated: field with a timezone offset or fractional seconds, making
the lock file content non-reproducible across machines even when the
same SOURCE_DATE_EPOCH value is used — defeating the purpose of the
feature.
Also add:
- testdata/charts/chart-with-lock fixture: a minimal chart with a
Chart.lock whose generated: timestamp predates SOURCE_DATE_EPOCH.
- TestRunWithSourceDateEpochStampsLockGenerated: packages the fixture
with SourceDateEpoch set to a non-UTC, sub-second time.Time and
asserts that the resulting archive's Chart.lock entry has both the
correct tar modtime and the correct (normalized) generated: value in
the marshaled YAML.
Signed-off-by: Ilya Kiselev <kis-ilya-a@yandex.ru>
Move description length validation to the beginning of Run(), before
IsReachable(), so programmatic callers get an immediate validation
error instead of a potentially misleading cluster reachability failure.
Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
Add a new --description flag to the helm rollback command that allows
users to specify a custom description explaining why the rollback was
performed. This description is stored in the release metadata.
Changes:
- Add Description field to the Rollback action struct
- Add --description flag to the rollback CLI command
- Add 512 character limit validation for the description
- Default to 'Rollback to <version>' when no description is provided
The description flag is optional and follows the same pattern used by
the install and upgrade commands.
Closes #XXXX
Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
Sam Darwin