Merge tag 'v3.21.4' into release-3.21

Helm release v3.21.4

# -----BEGIN PGP SIGNATURE-----
#
# iQJPBAABCAA5FiEEII3TbtW7N0WhZ0Okx8b7tbkcEVUFAmp+JikbFIAAAAAABAAO
# bWFudTIsMi41KzEuMTIsMCwzAAoJEMfG+7W5HBFVQRQQAJ3+AzVfWhY/rbMJ2Xh8
# 2nJlYvMvQPgfxwnCJlzYjp2w5HKD1iMu3/3or+D77IdFTYj3qctZmlR3O2AZYR5p
# MPfQRrSB3RAQdISMoza4+QaOZ3EWF4dfbrDUVO3x+GG8TQpHj4KU71k7VoJMfZOT
# Yl3X7D9/1wQfI4CYucFTI6prbA7vvaRcutEaYyQ4Beblh0GZV88qe31jOihPjDlP
# ndG5EogfY8bmO+Ni61qmxo/qr2sFelqp1F7E6k6XkKWa6C/WpQPf0MuE7IQx8XSN
# RhjVjaap2x2meMEyTAgKAdrBMRlGDeXLv7A6+JvqgWm+fN2zC1gvWUXEdz8mI5lN
# DoVnjslswUkLCn4QBfEsdQuRhiHkhypC5+iUwnk38VcWpWnSnycXJf4DsbYnKIRq
# VQwIxjTe+XLanmHiHTVzCos8I6tT0vfi3Co/SQR123kmH3TvtlvFsXBsRVxgD7Rs
# KREEilV9aLebiI60iQ+NrSaF4aG49/ZAaw7s1aW9pUq2UAsscoUj4R04IbG/aJOP
# XtWGsW+ki6ZDoMbuuT1cyKuLX2S7SmQvqOVXqrkWpYQ1QFOr4Zffsv89gT94qvTz
# Snv9yXGKK1Q7nUmYj2JiBeCOqEDZjgMFKoiZ83sKRGEyjXuD/U8D3FhCEWkRPnjw
# A9gnarLSiqRFGQcZPv24FXIw
# =fZrU
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri Aug 14 01:46:41 2026 IST
# gpg:                using RSA key 208DD36ED5BB3745A16743A4C7C6FBB5B91C1155
# gpg: Can't check signature: No public key

Author: baijum

go.mod

@@ -12,9 +12,9 @@ require (
 	github.com/Masterminds/sprig/v3 v3.3.0
 	github.com/Masterminds/squirrel v1.5.4
 	github.com/Masterminds/vcs v1.13.3
+	github.com/ProtonMail/go-crypto v1.4.1
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
-	github.com/containerd/containerd v1.7.32
-	github.com/cyphar/filepath-securejoin v0.6.1
+	github.com/cyphar/filepath-securejoin v0.7.0
 	github.com/distribution/distribution/v3 v3.1.1
 	github.com/evanphx/json-patch v5.9.11+incompatible
 	github.com/foxcpp/go-mockdns v1.2.0
@@ -35,9 +35,9 @@ require (
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
-	golang.org/x/crypto v0.53.0
-	golang.org/x/term v0.44.0
-	golang.org/x/text v0.38.0
+	golang.org/x/crypto v0.54.0
+	golang.org/x/term v0.45.0
+	golang.org/x/text v0.40.0
 	gopkg.in/yaml.v3 v3.0.1
 	k8s.io/api v0.36.2
 	k8s.io/apiextensions-apiserver v0.36.2
@@ -62,9 +62,7 @@ require (
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chai2010/gettext-go v1.0.2 // indirect
-	github.com/containerd/errdefs v0.3.0 // indirect
-	github.com/containerd/log v0.1.0 // indirect
-	github.com/containerd/platforms v0.2.1 // indirect
+	github.com/cloudflare/circl v1.6.3 // indirect
 	github.com/coreos/go-systemd/v22 v22.7.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
@@ -134,7 +132,7 @@ require (
 	go.opentelemetry.io/contrib/bridges/prometheus v0.67.0 // indirect
 	go.opentelemetry.io/contrib/exporters/autoexport v0.67.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
+	go.opentelemetry.io/otel v1.44.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 // indirect
@@ -147,24 +145,24 @@ require (
 	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0 // indirect
 	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0 // indirect
 	go.opentelemetry.io/otel/log v0.19.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
 	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
 	go.opentelemetry.io/otel/sdk/log v0.19.0 // indirect
 	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/mod v0.36.0 // indirect
-	golang.org/x/net v0.55.0 // indirect
-	golang.org/x/oauth2 v0.35.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
-	golang.org/x/tools v0.45.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect
-	google.golang.org/grpc v1.80.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
+	google.golang.org/grpc v1.82.1 // indirect
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect

go.sum

@@ -154,7 +154,7 @@ func (f files) AsSecrets() string {
 // {{ range .Files.Lines "foo/bar.html" }}
 // {{ . }}{{ end }}
 func (f files) Lines(path string) []string {
-	if f == nil || f[path] == nil {
+	if f == nil || len(f[path]) == 0 {
 		return []string{}
 	}
 	s := string(f[path])

pkg/engine/files.go

@@ -30,6 +30,8 @@ var cases = []struct {
 	{"story/author.txt", "Joseph Conrad"},
 	{"multiline/test.txt", "bar\nfoo\n"},
 	{"multiline/test_with_blank_lines.txt", "bar\nfoo\n\n\n"},
+	{"empty/empty.txt", ""},
+	{"empty/newline_only.txt", "\n"},
 }
 
 func getTestFiles() files {
@@ -109,3 +111,31 @@ func TestBlankLines(t *testing.T) {
 	as.Equal("bar", out[0])
 	as.Equal("", out[3])
 }
+
+func TestLinesEmptyFile(t *testing.T) {
+	as := assert.New(t)
+
+	f := getTestFiles()
+
+	out := f.Lines("empty/empty.txt")
+	as.Empty(out)
+}
+
+func TestLinesNewlineOnlyFile(t *testing.T) {
+	as := assert.New(t)
+
+	f := getTestFiles()
+
+	out := f.Lines("empty/newline_only.txt")
+	as.Len(out, 1)
+	as.Empty(out[0])
+}
+
+func TestLinesMissingFile(t *testing.T) {
+	as := assert.New(t)
+
+	f := getTestFiles()
+
+	out := f.Lines("nonexistent.txt")
+	as.Empty(out)
+}

pkg/engine/files_test.go

@@ -24,10 +24,10 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/ProtonMail/go-crypto/openpgp"
+	"github.com/ProtonMail/go-crypto/openpgp/clearsign"
+	"github.com/ProtonMail/go-crypto/openpgp/packet"
 	"github.com/pkg/errors"
-	"golang.org/x/crypto/openpgp"           //nolint
-	"golang.org/x/crypto/openpgp/clearsign" //nolint
-	"golang.org/x/crypto/openpgp/packet"    //nolint
 	"sigs.k8s.io/yaml"
 
 	hapi "helm.sh/helm/v3/pkg/chart"
@@ -314,8 +314,9 @@ func (s *Signatory) decodeSignature(filename string) (*clearsign.Block, error) {
 func (s *Signatory) verifySignature(block *clearsign.Block) (*openpgp.Entity, error) {
 	return openpgp.CheckDetachedSignature(
 		s.KeyRing,
-		bytes.NewBuffer(block.Bytes),
+		bytes.NewReader(block.Bytes),
 		block.ArmoredSignature.Body,
+		&defaultPGPConfig,
 	)
 }
 

pkg/provenance/sign.go

@@ -24,7 +24,8 @@ import (
 	"strings"
 	"testing"
 
-	pgperrors "golang.org/x/crypto/openpgp/errors" //nolint
+	pgperrors "github.com/ProtonMail/go-crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/packet"
 )
 
 const (
@@ -56,6 +57,9 @@ const (
 	// testTamperedSigBlock is a tampered copy of msgblock.yaml.asc
 	testTamperedSigBlock = "testdata/msgblock.yaml.tampered"
 
+	// testMixedKeyring points to a keyring containing RSA and ed25519 keys.
+	testMixedKeyring = "testdata/helm-mixed-keyring.pub"
+
 	// testSumfile points to a SHA256 sum generated by an external tool.
 	// We always want to validate against an external tool's representation to
 	// verify that we haven't done something stupid. This file was generated
@@ -232,6 +236,56 @@ func TestClearSign(t *testing.T) {
 	}
 }
 
+func TestMixedKeyringRSASigningAndVerification(t *testing.T) {
+	signer, err := NewFromFiles(testKeyfile, testMixedKeyring)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if signer.Entity == nil {
+		t.Fatal("expected signer entity to be loaded")
+	}
+
+	if signer.Entity.PrivateKey == nil {
+		t.Fatal("expected signer private key to be loaded")
+	}
+
+	if signer.Entity.PrivateKey.PubKeyAlgo != packet.PubKeyAlgoRSA {
+		t.Fatalf("expected RSA key but got %v", signer.Entity.PrivateKey.PubKeyAlgo)
+	}
+
+	sig, err := signer.ClearSign(testChartfile)
+	if err != nil {
+		t.Fatalf("failed to sign chart: %v", err)
+	}
+
+	sigpath := filepath.Join(t.TempDir(), "hashtest-1.2.3.tgz.prov")
+	if err := os.WriteFile(sigpath, []byte(sig), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	verification, err := signer.Verify(testChartfile, sigpath)
+	if err != nil {
+		t.Fatalf("failed to verify chart signature: %v", err)
+	}
+
+	if verification.SignedBy == nil {
+		t.Fatal("expected verification to include signer")
+	}
+
+	if verification.SignedBy.PrimaryKey == nil {
+		t.Fatal("expected verification to include signer primary key")
+	}
+
+	if verification.SignedBy.PrimaryKey.PubKeyAlgo != packet.PubKeyAlgoRSA {
+		t.Fatalf("expected verification to report RSA key but got %v", verification.SignedBy.PrimaryKey.PubKeyAlgo)
+	}
+
+	if _, ok := verification.SignedBy.Identities[testKeyName]; !ok {
+		t.Fatalf("expected verification to be signed by %q", testKeyName)
+	}
+}
+
 // failSigner always fails to sign and returns an error
 type failSigner struct{}
 

pkg/provenance/sign_test.go

@@ -31,7 +31,6 @@ import (
 	"sync"
 
 	"github.com/Masterminds/semver/v3"
-	"github.com/containerd/containerd/remotes"
 	"github.com/opencontainers/image-spec/specs-go"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/pkg/errors"
@@ -56,7 +55,7 @@ storing semantic versions, Helm adopts the convention of changing plus (+) to
 an underscore (_) in chart version tags when pushing to a registry and back to
 a plus (+) when pulling from a registry.`
 
-var errDeprecatedRemote = errors.New("providing github.com/containerd/containerd/remotes.Resolver via ClientOptResolver is no longer suported")
+var errDeprecatedRemote = errors.New("providing github.com/containerd/containerd/remotes.Resolver via ClientOptResolver is no longer supported")
 
 type (
 	// RemoteClient shadows the ORAS remote.Client interface
@@ -237,7 +236,7 @@ func ClientOptPlainHTTP() ClientOption {
 	}
 }
 
-func ClientOptResolver(_ remotes.Resolver) ClientOption {
+func ClientOptResolver(_ any) ClientOption {
 	return func(c *Client) {
 		c.err = errDeprecatedRemote
 	}

pkg/provenance/testdata/helm-mixed-keyring.pub

@@ -21,17 +21,14 @@ import (
 	"io"
 	"testing"
 
-	"github.com/containerd/containerd/remotes"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"oras.land/oras-go/v2/content/memory"
 )
 
 func TestNewClientResolverNotSupported(t *testing.T) {
-	var r remotes.Resolver
-
-	client, err := NewClient(ClientOptResolver(r))
+	client, err := NewClient(ClientOptResolver(nil))
 	require.Equal(t, err, errDeprecatedRemote)
 	assert.Nil(t, client)
 }