Return the actual error from io.Copy in Digest() instead of nil.
The previous code swallowed the error and returned an empty string
as a valid SHA-256 digest, which could silently break chart
provenance verification.
Also fix encodeRelease() in pkg/storage/driver/util.go:
- Close the gzip writer on the w.Write() error path to avoid
leaking resources.
- Check the error return from gzip.Writer.Close(), which flushes
remaining compressed data and can fail.
Assisted-by: Grok/xAI
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
(cherry picked from commit e095e690a8)
Sebastien Tardif
ff1ac83bfb