Document Chart.lock content digests and build-time verification#2153
Document Chart.lock content digests and build-time verification#2153promptless-for-oss wants to merge 1 commit into
Conversation
Document the per-dependency digest field added to Chart.lock, populated on helm dependency update and verified on helm dependency build, along with the chart.lock digest mismatch error and the non-fatal download WARNING. Refs helm/helm#32243. Signed-off-by: promptless[bot] <promptless[bot]@users.noreply.github.com>
| mysql-3.2.1.tgz | ||
| ``` | ||
|
|
||
| #### The Chart.lock file and content digests |
There was a problem hiding this comment.
PR #32243 adds the per-dependency digest field to Chart.lock. The Dependency.Digest field (pkg/chart/v2/dependency.go) carries the sha256: archive hash and is omitempty/omitted from Chart.yaml; the top-level Lock.Digest continues to hash only Chart.yaml constraints + resolved metadata, excluding per-dependency content digests (internal/resolver/resolver.go HashReq).
Source: helm/helm#32243
| dependency build` fails: | ||
|
|
||
| ```text | ||
| chart.lock digest mismatch for apache-1.2.3: expected sha256:..., got sha256:... |
There was a problem hiding this comment.
The fatal chart.lock digest mismatch for <name>-<version>: expected ..., got ... error text comes verbatim from recordDependencyDigest in pkg/downloader/digest.go; it fires on helm dependency build because downloadAll receives the lock's pre-populated dep.Digest. Re-running helm dependency update re-records the digest (empty dep.Digest on the resolve path), confirmed by TestContentDigestUpdateOnRepublish.
Source: helm/helm#32243
| downloaded. If the two do not match, Helm prints a warning to standard error: | ||
|
|
||
| ```text | ||
| WARNING: digest mismatch for <chart>: repository index has sha256:..., downloaded content has sha256:... |
There was a problem hiding this comment.
The non-fatal WARNING: digest mismatch for <ref>: repository index has sha256:..., downloaded content has sha256:... text and its informational (non-blocking) behavior come from verifyDownloadedDigest in pkg/downloader/chart_downloader.go, which only warns and still writes the chart. Legacy Chart.lock without digests building without error is confirmed by TestLegacyLockWithoutDigest.
Source: helm/helm#32243
2 participants
Open this suggestion in Promptless to view citations and reasoning process
Documents the new per-dependency
digestfield added to Chart.lock (helm/helm #32243), populated onhelm dependency updateand verified onhelm dependency build, including the chart.lock digest mismatch error and the non-fatal download WARNING.Trigger Events
Tip: Configure how Promptless handles changelogs in Agent Settings 📋