Skip to content

Document digest field for OCI chart dependencies #2115

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
promptless-for-oss wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Document digest field for OCI chart dependencies #2115

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
89bea27
docs: add digest field for OCI chart dependencies
promptless[bot] May 22, 2026
abb0701
Merge branch 'main' into promptless/document-oci-dependency-digest
promptless[bot] May 23, 2026
6c2d5ac
Merge branch 'main' into promptless/document-oci-dependency-digest
promptless[bot] May 25, 2026
335ff22
Merge branch 'main' into promptless/document-oci-dependency-digest
gjenkins8 Jun 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/topics/charts.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ dependencies: # A list of the chart requirements (optional)
- name: The name of the chart (nginx)
version: The version of the chart ("1.2.3")
repository: (optional) The repository URL ("https://example.com/charts") or alias ("@repo-name")
digest: (optional) The SHA256 digest for OCI dependencies, used instead of version tag for immutable references

@promptless-for-oss promptless-for-oss May 22, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added digest field to the Chart.yaml dependency documentation based on PR #32142 which adds the Digest field to the v3 chart schema in internal/chart/v3/dependency.go.

Source: helm/helm#32142

condition: (optional) A yaml path that resolves to a boolean, used for enabling/disabling charts (e.g. subchart1.enabled )
tags: # (optional)
- Tags can be used to group charts for enabling/disabling together
Expand Down
22 changes: 21 additions & 1 deletion docs/topics/registries.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,14 +185,34 @@ Dependencies of a chart can be pulled from a registry using the `dependency upda

The `repository` for a given entry in `Chart.yaml` is specified as the registry reference without the basename:

```
```yaml
dependencies:
- name: mychart
version: "2.7.0"
repository: "oci://localhost:5000/myrepo"
```
This will fetch `oci://localhost:5000/myrepo/mychart:2.7.0` when `dependency update` is executed.

### Specifying dependencies with digest

@promptless-for-oss promptless-for-oss May 22, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added the digest field documentation based on PR #32142 which adds OCI digest tracking support for Helm v4 dependencies. The PR adds a Digest field to internal/chart/v3/dependency.go and modifies pkg/downloader/manager.go to construct URLs with @sha256: when a digest is specified.

Source: helm/helm#32142


You can specify a SHA256 digest instead of relying on version tags. Digests are immutable, so they provide stronger guarantees that you get the exact chart artifact you expect. When a `digest` is specified, Helm fetches the dependency using the digest rather than the version tag:

```yaml
dependencies:
- name: mychart
version: "2.7.0"
repository: "oci://localhost:5000/myrepo"
digest: "sha256:ec5f08ee7be8b557cd1fc5ae1a0ac985e8538da7c93f51a51eff4b277509a723"
```

This will fetch `oci://localhost:5000/myrepo/mychart@sha256:ec5f08ee7be8b557cd1fc5ae1a0ac985e8538da7c93f51a51eff4b277509a723` when `dependency update` is executed.

Because digests are immutable, they are useful for:

- **Reproducible builds**: The same dependency content is used across different environments
- **Supply chain security**: Version tags cannot be overwritten to point to different content
- **Audit compliance**: An exact record of which artifacts were deployed

## Helm chart manifest

Example Helm chart manifest as represented in a registry
Expand Down
Loading