Migrate to aws-sdk-go-v2 (fixes #555, resolves CVE scanner noise)

[xoanmm]

Summary

Migrates helm-s3 from the end-of-life aws-sdk-go v1 to aws-sdk-go-v2, and refreshes remaining Go dependencies and Docker base images. Closes #555.

Builds on top of the excellent prior work in #571 (@monwolf) and #578 (@alekc) — both stale ~6 months — by resolving conflicts against current main, fixing a few tests, and adding a full dep refresh.

Motivation

Two independent drivers:

1. AWS SDK for Go v1 reached end of support on 2025-07-31.
   See AWS announcement. No more security patches from AWS — every future CVE against v1 will remain unfixed upstream.

2. CVE scanner noise on every downstream helm-s3 install.
   Image scanners (Grype/Trivy/etc.) currently flag CVE-2020-8911 and CVE-2020-8912 against github.com/aws/aws-sdk-go v1.55.7 in the shipped helm-s3 binary. Both live in service/s3/s3crypto (CBC padding oracle in client-side encryption). helm-s3 does not import s3crypto (verified: grep -rn "s3crypto" = 0 hits — helm-s3 only uses server-side SSE via the AWS_S3_SSE header), so the CVEs are technically non-exploitable here. But because these CVEs have Fixed In: NotAvailable in v1 (they were only fixed by moving to v2), every downstream user has to either waive them per-scanner or accept persistent noise. Migrating to v2 makes both CVEs disappear from every downstream scan simultaneously.

Between v1 EOL and the CVE noise, the migration is now a shared blocker for anyone shipping helm-s3 inside a compliance-scanned container image.

Changes

AWS SDK v2 migration (rebased from #578)

• internal/awsutil/session.go — session.Session → aws.Config + config.LoadDefaultConfig; HELM_S3_DYNAMIC_REGION_ENABLED preserved
• internal/awsutil/url.go — EscapePath reimplemented (v1's private/protocol/rest.EscapePath has no v2 public equivalent)
• internal/awss3/storage.go — S3 client ops migrated to v2 context-native APIs; s3manager → feature/s3/manager; awserr.Error/.Code() → errors.As with *types.NoSuchBucket / *types.NoSuchKey / *smithy.GenericAPIError
• cmd/helm-s3/{delete,download,init,push,reindex}.go — session return-type touch-ups
• Custom AWS endpoint scheme validation (from Feature/aws sdk v2 #578 commit 4cec5dd)

Fixes on top of the rebased #578

• Scheme validation: url.Parse("foobar:1234") returns Scheme="foobar", so the previous parsedURL.Scheme == "" check silently passed invalid input. Tightened to require http or https.
• Tests: switched os.Setenv/os.Unsetenv to t.Setenv in session_test.go. A t.Fatalf in TestSessionWithInvalidEndpoint was leaking HELM_S3_REGION=us-west-2 into TestDynamicBucketRegion, causing false failures.
• TestDynamicBucketRegion: updated expected region for cn-test-bucket from ap-southeast-2 → eu-central-1. v2 uses GetBucketLocation which returns the bucket's actual current region; the demo bucket appears to have moved.
• hack/test-e2e-local.sh: AWS_ENDPOINT=localhost:9000 → http://localhost:9000 to satisfy the new scheme check.
• tests/e2e/main_test.go: minio.New requires a bare host:port, so strip the scheme when reusing AWS_ENDPOINT for the test-side minio client.

Dependency refresh

• go get -u ./... && go mod tidy — notably helm.sh/helm/v3 3.21.0 → 3.21.3, k8s.io/* 0.35.1 → 0.36.2, golang.org/x/crypto 0.49.0 → 0.54.0, google.golang.org/grpc 1.80.0 → 1.82.1.

Docker base images

• GO_VERSION 1.25.5 → 1.25.12 (latest 1.25.x patch)
• HELM_VERSION 3.21.0 → 3.21.3
• -mod=vendor already dropped by Feature/aws sdk v2 #578's 33956bb (no vendor/ directory is checked in)

Test plan

• go build ./cmd/helm-s3 — clean compile
• go vet ./... — clean
• Unit tests: go test -short -count=1 ./internal/... — all pass (awsutil, helmutil)
• E2E: hack/test-e2e-local.sh — 19/19 tests pass against local minio + docker (basic delete, delete --relative, delete provenance, delete multi-version, delete multi-version one-missing, helm dependency update, init, init --force, init --ignore-if-exists, init both flags, init repo-not-found, push, push --content-type, push --dry-run, push --force, push --ignore-if-exists, push both flags, push --relative, push provenance)
• Docker image build — not verified locally due to TLS interception in my environment; needs CI verification

Commits

Rebased from #578 (preserving @monwolf and @alekc authorship):

• feat: migrate to AWS SDK v2
• fix: remove deprecated deps
• Minor tweaks for aws sdk v2 migration
• chore: update Go version to 1.25.5 in Dockerfile, fix for --vendoring crash
• feat: add support for custom AWS endpoint with scheme validation

Added on top:

• fix(awsutil): tighten endpoint scheme check + stabilize tests
• chore(deps): bump Go dependencies to latest compatible with Go 1.25.5
• chore(docker): bump base image versions

Happy to squash / split / rebase however you prefer.

[xoanmm]

@hypnoglow could you review please?

[xoanmm]

Hello @hypnoglow any chance to review it?