Inconsistent digest + tag handling in helm 4 install with OCI Chart #31600
Description
What happened?
I tried many different references with unexpected results:
For reference, the tag in the registry is 1.4.2, and digest is sha256:aef46c66a7f2d5a12a7e3f54a64790daf5c9a9e66af3f46955efdaa6c900341d. A tag v1.4.2 does NOT exist.
# tag only
$ helm4 upgrade --install nginx-ingress oci://ghcr.io/nginxinc/charts/nginx-ingress:1.4.2
# works
# tag with "v"
$ helm4 upgrade --install nginx-ingress oci://ghcr.io/nginxinc/charts/nginx-ingress:v1.4.2
Error: failed to perform "FetchReference" on source: ghcr.io/nginxinc/charts/nginx-ingress:v1.4.2: not found
# digest only
$ helm4 upgrade --install nginx-ingress oci://ghcr.io/nginxinc/charts/nginx-ingress@sha256:aef46c66a7f2d5a12a7e3f54a64790daf5c9a9e66af3f46955efdaa6c900341d
# works
# tag without "v" and digest
$ helm4 upgrade --install nginx-ingress oci://ghcr.io/nginxinc/charts/nginx-ingress:1.4.2@sha256:aef46c66a7f2d5a12a7e3f54a64790daf5c9a9e66af3f46955efdaa6c900341d
Error: encoding/hex: invalid byte: U+0073 's'
# tag with "v" and digest
$ helm4 upgrade --install nginx-ingress oci://ghcr.io/nginxinc/charts/nginx-ingress:v1.4.2@sha256:aef46c66a7f2d5a12a7e3f54a64790daf5c9a9e66af3f46955efdaa6c900341d
# works
# tag + wrong digest
$ helm4 upgrade --install nginx-ingress oci://ghcr.io/nginxinc/charts/nginx-ingress:1.4.2@sha256:aef46c66a7f2d5a12a7e3f54a64790daf5c9a9e66af3f46955efdaa6c9003xxx
Error: invalid reference: invalid digest "sha256:aef46c66a7f2d5a12a7e3f54a64790daf5c9a9e66af3f46955efdaa6c9003xxx": invalid checksum digest format
# unexpected, but very nice
# Wrong tag + digest
$ helm4 upgrade --install nginx-ingress oci://ghcr.io/nginxinc/charts/nginx-ingress:v1.4.2xxx@sha256:aef46c66a7f2d5a12a7e3f54a64790daf5c9a9e66af3f46955efdaa6c900341d
# worksWhat did you expect to happen?
More consistency:
- tag+digest should work. Why does it only work with an invalid tag?
- if specifying a wrong digest gets validated, the reverse should also be true. If the tag points to a different digest this should cause an error
- actually, most client usually ignore the tag entirely if a digest is present. But as-is the helm4 implementation is inconsistent.
How can we reproduce it (as minimally and precisely as possible)?
See my sample commands above.
Helm version
Details
$ helm4 version
version.BuildInfo{Version:"v4.0.1", GitCommit:"12500dd401faa7629f30ba5d5bff36287f3e94d3", GitTreeState:"clean", GoVersion:"go1.25.4", KubeClientVersion:"v1.34"}```
</details>
### Kubernetes version
<details>
```console
$ kubectl version
Client Version: v1.34.1
Kustomize Version: v5.7.1
Server Version: v1.34.0```
</details>