* refactor: remove per-file decompression size limit
Remove MaxDecompressedFileSize as it's no longer necessary after
migrating to a maintained JSON schema library (santhosh-tekuri/jsonschema/v6).
The original limit was added to protect against vulnerabilities in an
unmaintained library.
The total decompressed chart size limit (MaxDecompressedChartSize) remains
to protect against other attack vectors.
Partially resolves#30738
Related:
- https://github.com/helm/helm/pull/30743
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* fix: deprecate MaxDecompressedFileSize instead of removing
As Matt suggested we should keep the variable until v5 as it can be used
because it is public.
Related:
- https://github.com/helm/helm/pull/31748#discussion_r2738518696
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* fix: enforce aggregate size budget on directory loading
Directory-based chart loading (`LoadDir`) used unbounded `os.ReadFile`
calls with no total size check. Archive loading already enforces
`MaxDecompressedChartSize` via a remaining-byte budget but directory
loading did not, leaving local charts and `file://` dependencies as
an unbounded memory path.
Add `ReadFileWithBudget` in the archive package and use it in both
v2 and v3 directory loaders so they track the same aggregate budget.
Ref: https://github.com/helm/helm/pull/31748#issuecomment-4138927643
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* fix: cap directory budget reads with LimitReader
Use `os.Open` + `io.LimitReader` instead of `os.ReadFile` in
`ReadFileWithBudget` so a file that grows between stat and read
cannot allocate unbounded memory.
Also fix `MaxDecompressedFileSize` doc comment to reflect it is
unused/deprecated, add nil guard on remaining, and check
`os.Stat` errors in tests.
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* test: add v3 directory loader budget test
Mirror the v2 `TestLoadDirExceedsBudget` test for the v3 loader
to prevent budget enforcement regressions in either path.
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* refactor(loader): make read budget configurable
Follow recommendations from https://github.com/helm/helm/pull/31748#discussion_r3058581419
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* fix(loader): export BudgetedReader for cross-package use
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* fix(loader): rename max param to avoid shadowing built-in
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
---------
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
This is needed for goreleaser to create updates. Its latest release
needs it.
Updates needed for linting and to fix failed tests resulting from
Go std library changes.
Signed-off-by: Matt Farina <matt.farina@suse.com>
YAMLReader can return EOF without yielding the last line when that line
has no trailing newline and its length is a multiple of bufio's default
buffer. Read the file fully and ensure a trailing newline before parsing
so compact JSON values files are not silently ignored.
Fixes#32506
Signed-off-by: Dean Chen <862469039@qq.com>
Closes#32396.
StampModTimes now normalizes the supplied time to UTC and truncates to
whole seconds before stamping. Without this, an SDK caller passing a
local-timezone or sub-second time.Time would produce a Chart.lock
generated: field with a timezone offset or fractional seconds, making
the lock file content non-reproducible across machines even when the
same SOURCE_DATE_EPOCH value is used — defeating the purpose of the
feature.
Also add:
- testdata/charts/chart-with-lock fixture: a minimal chart with a
Chart.lock whose generated: timestamp predates SOURCE_DATE_EPOCH.
- TestRunWithSourceDateEpochStampsLockGenerated: packages the fixture
with SourceDateEpoch set to a non-UTC, sub-second time.Time and
asserts that the resulting archive's Chart.lock entry has both the
correct tar modtime and the correct (normalized) generated: value in
the marshaled YAML.
Signed-off-by: Ilya Kiselev <kis-ilya-a@yandex.ru>
Pre-Go-modules import path comments (e.g. `// import "helm.sh/helm/v4/..."`)
are obsolete since Go 1.11 where go.mod is the authoritative module path.
These stale comments cause issues with downstream tooling such as Kythe.
Removes the legacy import comments from 64 files across 20 packages:
- cmd/helm
- internal/chart/v3/lint and sub-packages
- internal/plugin and sub-packages
- internal/release/v2/util
- pkg/chart/v2/lint and sub-packages
- pkg/cmd, pkg/engine, pkg/ignore, pkg/provenance
- pkg/registry
- pkg/release/v1/util
- pkg/repo/v1
- pkg/storage and pkg/storage/driver
Follows up on #31931 and #31932 which addressed pkg/kube.
Fixes#31846
Signed-off-by: abhay1999 <abhay.chaurasiya@example.com>
Signed-off-by: abhay1999 <abhaychaurasiya19@gmail.com>
* feat: honor SOURCE_DATE_EPOCH for chart archives
Add StampModTimes() on Chart struct to recursively set ModTime on
all chart file entries. CLI reads SOURCE_DATE_EPOCH env var and wires
through all 5 commands: package, install, upgrade, dep build, dep update.
Removes unused v3 duplicate source_date_epoch.go (YAGNI).
Inlines env var parsing to CLI layer from chart util.
Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>
* docs: document SOURCE_DATE_EPOCH in environment variables help
Add a short entry for $SOURCE_DATE_EPOCH to the env var table shown
in 'helm help'. The variable is honored by 'helm package', 'install',
'upgrade', 'dep build', and 'dep update' to produce reproducible chart
archives. Full documentation belongs in helm-www.
Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>
* fix: adapt SourceDateEpoch to upstream refactored dep check
Upstream/main restructured the dependency error handling in install.go
and upgrade.go from a nested-if block (if DependencyUpdate) to an
early-return pattern (if !DependencyUpdate). Adapt the feature's
Manager construction to match the new code structure.
Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>
---------
Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>
Sam Darwin