v0.16.0

ChartMuseum v0.16.0 is a feature release. This release, we focused on . Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

• Join the discussion in Kubernetes Slack:
  • for discussing PRs, code, bugs, or just to hang out
• Hang out at the Helm Public Developer Call: Thursday, 9:30 Pacific via Zoom

Installation and Upgrading

Download ChartMuseum v0.16.0. The common platform binaries are here:

• MacOS amd64 (archive sig / checksum / checksum sig / c0fbeeb05b896ea46485079a06b53d78d18791fb9403387a393175a76aa7904e)
• Linux amd64 (archive sig / checksum / checksum sig / 97c635fcfdcd07410cf6aada42491177b9c8ac67094cdbf24da60d18de34bd44)
• Linux arm (archive sig / checksum / checksum sig / becbe4173f391c5d580fb0f6e3aa95347700ef23086dd25d6b7d5fdccba2aa17)
• Linux arm64 (archive sig / checksum / checksum sig / 1efe913d9b86a5761ce9105da801805a545a2e9f0b32d12b7fd37087592d8184)
• Linux i386 (archive sig / checksum / checksum sig / c61d2d4d79c4ea23656ff52e4a563213938bafabe78956f534f57f57b3bc9ac4)
• Linux mips64le (archive sig / checksum / checksum sig / 8d173bd05b6a0d8e8e1b23479a0d933c782f7a6a932f70c6d6b23d54f0ae8fa0)
• Linux ppc64le (archive sig / checksum / checksum sig / 66d21f0559a3eab42a746f2ae517e3ee3e697d598c1b9e95092207c9e3b613aa)
• Linux s390x (archive sig / checksum / checksum sig / ca7156be5c03baeeb244a9aaebf880fb978e06d73fe06609ed8eb3b7bb6c5ace)
• Windows amd64 (archive sig / checksum / checksum sig / 7ad73b0aa533415e024a359339a47bcf3f436e6fbcdc9accd78f02de4f7256d2)

You can download the SBOM for this release in SPDX format here.

You can use a script to install on any system with bash.

What's Next

• 0.16.1 will contain only bug fixes.
• 0.17.0 is the next feature release.

Software Bill of Materials (SBOM)

You can download the SBOM for this release in SPDX format here. You can use bom to inspect the contents:

curl -sL -o sbom.spdx https://get.helm.sh/chartmuseum-v0.16.0.spdx
bom document outline sbom.spdx

The SBOM has also been uploaded to the registry alongside the image, and can be fetched using cosign:

cosign download sbom ghcr.io/helm/chartmuseum:v0.16.0 --output-file=sbom.spdx
bom document outline sbom.spdx

Digital Signatures

In this release, we have integrated with the sigstore project to produce digital signatures of container images.

To verify these signatures, you can use cosign.

Verify the container image:

cosign verify ghcr.io/helm/chartmuseum:v0.16.0 \
  --certificate-identity=https://github.com/helm/chartmuseum/.github/workflows/build.yml@refs/tags/v0.16.0 \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com | jq

Since the install script has used gpg in the past, signatures in this format have also been added (see .asc files attached to release). These were created with E97F 9DA5 AE2E 39CF 48A1 42B7 852A 7470 A39F B81D (@jdolitsky's GPG key) which can be found here and here.

Changelog

• build(deps): bump github.com/urfave/cli from 1.22.13 to 1.22.14 (#695) 31cd02b074a1beb6c85cdb657e0b1fdb1e78970b (dependabot[bot])
• Update various dependencies, prep for 0.16.0 release (#693) 34c66b7d024dfb9b40f46b645aa46df8b944398f (Josh Dolitsky)
• chore: replace github.com/ghodss/yaml with sigs.k8s.io/yaml (#692) 6c0976ff6b2b5f7019b467956f041cdce500c011 (Eng Zer Jun)
• build(deps): bump github.com/docker/distribution (#684) dab05fc930dc59b0d15ec76ce4951be5dca677b9 (dependabot[bot])
• build(deps): bump github.com/gin-gonic/gin from 1.9.0 to 1.9.1 (#690) 95e4555171a050edf8f038f7cb03b2f1df6611cf (dependabot[bot])
• replace io/ioutil package with os package (#685) a238f4a0fc9dcb6c6573f20ae8b9409e5e3c75d0 (smoky)
• build(deps): bump flask from 2.2.2 to 2.3.2 in /loadtesting (#681) 72bdd1e8325047ce7e8a38b749196e0bad5a8c18 (dependabot[bot])
• build(deps): bump helm.sh/helm/v3 from 3.11.2 to 3.11.3 (#679) 95e8f78ed87d7f638ad110f1a3b95fe636169314 (dependabot[bot])
• build(deps): bump github.com/spf13/viper from 1.14.0 to 1.15.0 (#661) a02769a5d23ba49afb247ba1b0ca8ca7efa6c335 (dependabot[bot])
• build(deps): bump github.com/urfave/cli from 1.22.10 to 1.22.12 (#662) 00017d359f6c68750bf74eab43b869fd0cfe8d00 (dependabot[bot])
• build(deps): bump github.com/gin-gonic/gin from 1.8.1 to 1.9.0 (#668) 7370316fd993dcaa311e43ef3bf54190a879db6e (dependabot[bot])
• build(deps): bump helm.sh/helm/v3 from 3.10.3 to 3.11.2 (#671) b6cc2fc08763390f46ad5c82db7f58afd1f08926 (dependabot[bot])
• build(deps): bump golang.org/x/net (#669) 02aa766ba7f53b4ca96736f3dd9f9bc4ce406e07 (dependabot[bot])
• fix: update URLs in k8s mirror script (#667) cff7886cd6c4f32111855828ac6fd7923f1223d3 (Syoc)
• ci: pin buildx version (#664) 61fbe1378675cb636349d4b652717468c8f92dea (Casey Buto)
• feat: Remove NetEase object storage provider (#656) 5d9b509e93a5252d57068789061fb524e1c92d93 (Casey Buto)
• build(deps): bump helm.sh/helm/v3 from 3.10.2 to 3.10.3 (#649) f104113eaccc600dc34318a697c8501fc3c35281 (dependabot[bot])
• build(deps): bump certifi from 2021.10.8 to 2022.12.7 in /loadtesting (#648) 7eed227ae9a6268287f691a07a31c1ab19be479b (dependabot[bot])
• build(deps): bump go.uber.org/zap from 1.23.0 to 1.24.0 (#645) a85dc18ae1526a5400d306728e4ed284888ef5f4 (dependabot[bot])
• build(deps): bump github.com/gofrs/uuid (#637) b319ac8b07f0466b249c6131a6f07fe122f4cce4 (dependabot[bot])
• build(deps): bump helm.sh/helm/v3 from 3.10.1 to 3.10.2 (#641) 0e999eba86fb57abfe7946fb5e6013866cfd81da (dependabot[bot])
• action: fix cosign invalid key 4803da29ed6a254a22cae05c4d0ff9221902a54f (scbizu)
• makefile: replace go get to go install 6363e95735afeadf72e1922d0260b30f9e6d664e (scbizu)
• build(deps): bump github.com/spf13/viper from 1.13.0 to 1.14.0 (#639) f1789fdfcfcadd374a7cc2cc999fdbec0b3c60ac (dependabot[bot])
• build(deps): bump github.com/prometheus/client_golang (#640) 05549fc0e1ca5502b3fe399aefa4f89a974a9f59 (dependabot[bot])
• mod: bump go to 1.19 and bump helm dependency (#634) a3629ef8521b1c6149c885482a87272f9b8c6b78 (Nace Sc)
• Added HEAD route for index.yaml (#630) 09dfc9c2e3096925cd2bdbe9de0608f98bf09cc9 (Skiepp)
• Feat/add-golang-lint (#623) 3b0f27ac4cd704b277c15cc1e0761562d6f8b929 (Obinna Odirionye)
• build(deps): bump github.com/urfave/cli from 1.22.9 to 1.22.10 (#614) 7866801a0a95eea776bac3cd4d06b0a21d8b770c (dependabot[bot])
• build(deps): bump github.com/gofrs/uuid (#619) 240627cb0640b5abad1f53fc952ac059db27d562 (dependabot[bot])
• build(deps): bump github.com/chartmuseum/storage from 0.12.4 to 0.12.5 (#621) ed37db2eab4672cda79bf4ef370dea7387ca7e52 (dependabot[bot])
• build(deps): bump github.com/spf13/viper from 1.12.0 to 1.13.0 (#616) bfe3f295ac9df08c318a064c10f5deb64c578c5c (dependabot[bot])
• build(deps): bump go.uber.org/zap from 1.22.0 to 1.23.0 (#613) 830ac2467e0c6aecabc107a2aa53c84ce4b2e013 (dependabot[bot])
• build(deps): bump helm.sh/helm/v3 from 3.9.2 to 3.9.3 (#610) 64cde313a748e92dc65a482ccc6e5b3741c17b50 (dependabot[bot])
• build(deps): bump go.uber.org/zap from 1.21.0 to 1.22.0 (#609) 727e91949113b837adeb34dfe81f9e6e31000d9b (dependabot[bot])
• build(deps): bump github.com/prometheus/client_golang (#608) d0d4d5396290aa04818258f6364f5cd21bc6f201 (dependabot[bot])
• pkg/chartmuseum,cmd: introduce the new keep-chart-always-up-to-date flag and the default cache interval when not set. (#593) 3ae6ed2d93b271ee474c093c4c8af82e44da239e (Nace Sc)
• build(deps): bump helm.sh/helm/v3 from 3.9.1 to 3.9.2 (#606) 1ae69818a358e04a0988a79e15d126e1690ac391 (dependabot[bot])
• build(deps): bump github.com/sirupsen/logrus from 1.8.1 to 1.9.0 (#605) a6eb57e8220bcb1d596628ac61367efaec52a9ea (dependabot[bot])
• build(deps): bump helm.sh/helm/v3 from 3.9.0 to 3.9.1 (#602) ebbc7f067156d73e35a23316b812a1968b318c09 (dependabot[bot])
• build(deps): bump github.com/stretchr/testify from 1.7.2 to 1.8.0 (#600) a50d99ddff12ae7b28d765fa9e44a6e348c037f9 (dependabot[bot])
• build: bump cosign to v1.9.0 (#601) 2e385aecaa7e5c24e1167a6c25ff2a4b6b70db98 (Casey Buto)