diff --git a/chart-sync/go.mod b/chart-sync/go.mod index 08db0fc84..523228724 100644 --- a/chart-sync/go.mod +++ b/chart-sync/go.mod @@ -2,7 +2,10 @@ module github.com/devtron-labs/chart-sync go 1.25.0 -replace github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260707131338-7cbce898d5fc +replace ( + github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260707131338-7cbce898d5fc + helm.sh/helm/v3 v3.20.2 => github.com/devtron-labs/helm/v3 v3.20.2 +) require ( github.com/caarlos0/env v3.5.0+incompatible @@ -14,7 +17,7 @@ require ( github.com/prometheus/client_golang v1.23.2 go.uber.org/zap v1.27.0 golang.org/x/exp v0.0.0-20250506013437-ce4c2cf36ca6 - helm.sh/helm/v3 v3.20.1 + helm.sh/helm/v3 v3.20.2 ) require ( diff --git a/chart-sync/go.sum b/chart-sync/go.sum index 88f2823a0..7f504382b 100644 --- a/chart-sync/go.sum +++ b/chart-sync/go.sum @@ -43,6 +43,8 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260707131338-7cbce898d5fc h1:vUG3Va+7UGT36MPJL1l/VckJUVj36YG6aX6HimNGluY= github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260707131338-7cbce898d5fc/go.mod h1:pehekzNkt2KRGZ3VC1b274Qq3iPBh27vGTby88T6KtI= +github.com/devtron-labs/helm/v3 v3.20.2 h1:6BRuozHsN52kO/bprPBVX7aX8frS7Sx9SlmGdyrhHn8= +github.com/devtron-labs/helm/v3 v3.20.2/go.mod h1:Fl1kBaWCpkUrM6IYXPjQ3bdZQfFrogKArqptvueZ6Ww= github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78= github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc= github.com/distribution/distribution/v3 v3.0.0 h1:q4R8wemdRQDClzoNNStftB2ZAfqOiN6UX90KJc4HjyM= @@ -431,8 +433,6 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -helm.sh/helm/v3 v3.20.1 h1:T8PodUaH1UwNvE+imUA2mIKjJItY8g7CVvLVP5g4NzI= -helm.sh/helm/v3 v3.20.1/go.mod h1:Fl1kBaWCpkUrM6IYXPjQ3bdZQfFrogKArqptvueZ6Ww= k8s.io/api v0.35.1 h1:0PO/1FhlK/EQNVK5+txc4FuhQibV25VLSdLMmGpDE/Q= k8s.io/api v0.35.1/go.mod h1:28uR9xlXWml9eT0uaGo6y71xK86JBELShLy4wR1XtxM= k8s.io/apiextensions-apiserver v0.35.1 h1:p5vvALkknlOcAqARwjS20kJffgzHqwyQRM8vHLwgU7w= diff --git a/chart-sync/pkg/RepoManager.go b/chart-sync/pkg/RepoManager.go index 87fa966b9..a41f0b1a4 100644 --- a/chart-sync/pkg/RepoManager.go +++ b/chart-sync/pkg/RepoManager.go @@ -3,6 +3,9 @@ package pkg import ( "bytes" "fmt" + "path" + "strings" + "github.com/devtron-labs/chart-sync/internals/sql" "github.com/devtron-labs/chart-sync/util" registry2 "github.com/devtron-labs/common-lib/helmLib/registry" @@ -13,8 +16,6 @@ import ( "helm.sh/helm/v3/pkg/getter" "helm.sh/helm/v3/pkg/registry" "helm.sh/helm/v3/pkg/repo" - "path" - "strings" ) const ( @@ -159,7 +160,7 @@ func (impl *HelmRepoManagerImpl) OCIRepoValuesJson(client *registry.Client, regi func (impl *HelmRepoManagerImpl) FetchOCIChartTagsList(settings *registry2.Settings, ociRepoURL string) ([]string, error) { // Retrieve list of repository tags client := settings.RegistryClient - tags, err := client.Tags(strings.TrimPrefix(ociRepoURL, fmt.Sprintf("%s://", registry.OCIScheme))) + tags, err := client.FetchAllTags(strings.TrimPrefix(ociRepoURL, fmt.Sprintf("%s://", registry.OCIScheme))) if err != nil || len(tags) == 0 { if err != nil { err = fmt.Errorf("unable to locate any tags in provided repository: %s", ociRepoURL) diff --git a/chart-sync/vendor/helm.sh/helm/v3/pkg/chart/metadata.go b/chart-sync/vendor/helm.sh/helm/v3/pkg/chart/metadata.go index a08a97cd1..0e78fda4e 100644 --- a/chart-sync/vendor/helm.sh/helm/v3/pkg/chart/metadata.go +++ b/chart-sync/vendor/helm.sh/helm/v3/pkg/chart/metadata.go @@ -112,6 +112,9 @@ func (md *Metadata) Validate() error { return ValidationError("chart.metadata.name is required") } + if md.Name == "." || md.Name == ".." { + return ValidationErrorf("chart.metadata.name %q is not allowed", md.Name) + } if md.Name != filepath.Base(md.Name) { return ValidationErrorf("chart.metadata.name %q is invalid", md.Name) } diff --git a/chart-sync/vendor/helm.sh/helm/v3/pkg/registry/clientExtended.go b/chart-sync/vendor/helm.sh/helm/v3/pkg/registry/clientExtended.go new file mode 100644 index 000000000..6abb5fb87 --- /dev/null +++ b/chart-sync/vendor/helm.sh/helm/v3/pkg/registry/clientExtended.go @@ -0,0 +1,52 @@ +package registry + +import ( + "context" + "strings" + + "oras.land/oras-go/v2/registry" + "oras.land/oras-go/v2/registry/remote" +) + +// FetchAllTags implements Tags function but removes semver StrictNewVersion check +// fix for issue https://github.com/devtron-labs/devtron/issues/4385, tags were not semver compatible, so they were getting filtered by StrictNewVersion check +func (c *Client) FetchAllTags(ref string) ([]string, error) { + parsedReference, err := registry.ParseReference(ref) + if err != nil { + return nil, err + } + + repository, err := remote.NewRepository(parsedReference.String()) + if err != nil { + return nil, err + } + repository.PlainHTTP = c.plainHTTP + repository.Client = c.authorizer + tags, err := fetchTags(context.Background(), repository) + if err == nil { + return tags, nil + } + + if repository.PlainHTTP || !strings.Contains(err.Error(), "server gave HTTP response") { + return nil, err + } + + repository.PlainHTTP = true + return fetchTags(context.Background(), repository) + +} + +func fetchTags(ctx context.Context, repository *remote.Repository) ([]string, error) { + var tags []string + + err := repository.Tags(ctx, "", func(batch []string) error { + tags = append(tags, batch...) + return nil + }) + + if err != nil { + return nil, err + } + + return tags, nil +} diff --git a/chart-sync/vendor/modules.txt b/chart-sync/vendor/modules.txt index 69cf0d831..a310c9575 100644 --- a/chart-sync/vendor/modules.txt +++ b/chart-sync/vendor/modules.txt @@ -454,7 +454,7 @@ gopkg.in/yaml.v2 # gopkg.in/yaml.v3 v3.0.1 ## explicit gopkg.in/yaml.v3 -# helm.sh/helm/v3 v3.20.1 +# helm.sh/helm/v3 v3.20.2 => github.com/devtron-labs/helm/v3 v3.20.2 ## explicit; go 1.25.0 helm.sh/helm/v3/internal/fileutil helm.sh/helm/v3/internal/sympath