helm/chartmuseum v0.15.0

ChartMuseum v0.15.0

on GitHub

v0.15.0

ChartMuseum v0.15.0 is a feature release. This release, we focused on various new features plus some significant performance improvements. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

• Join the discussion in Kubernetes Slack:
  • for discussing PRs, code, bugs, or just to hang out
• Hang out at the Helm Public Developer Call: Thursday, 9:30 Pacific via Zoom

Notable Changes

⚠️ Breaking Changes ⚠️

• --disable-metrics has been renamed to --enable-metrics and the /metrics endpoint is now disabled by default

✨ New features ✨

• The welcome page is now customizable via the --web-template-path flag (thanks @dirien! 🎉 )
• ChartMuseum can now be configured to host artifacthub-repo.yml files via the --artifact-hub-repo-id flag

Installation and Upgrading

Download ChartMuseum v0.15.0. The common platform binaries are here:

• MacOS amd64 (archive sig / checksum / checksum sig / 54dc2e08e59da3615697eb2943e24b21fe6a1f4d07a6715cc227f12c90539b3e)
• Linux amd64 (archive sig / checksum / checksum sig / ffd4a8c118ae1f641800c7445fa0f59a53ed73309e1db55a04df6cc85fc8253e)
• Linux arm (archive sig / checksum / checksum sig / 1175d46327d819da8014a2277a28e32aa513de70f8e1b77a5d14c0134a9a2101)
• Linux arm64 (archive sig / checksum / checksum sig / 1178eb6d04bb287d0b9946c38481fa2f172284c05fe2a1d1456bb13c4ac75413)
• Linux i386 (archive sig / checksum / checksum sig / 1b9561f44f06068024af46ad8a974ec4043b60eba2c51b0c0483bb3d886bf43f)
• Linux mips64le (archive sig / checksum / checksum sig / bc543353802e34e7058afbfb7533abddc29c554905a56497acee183e9813fd37)
• Linux ppc64le (archive sig / checksum / checksum sig / 15fee457086e8a6e192400a8bbbd07a842039ed8963508fd664f5873fd40d5ef)
• Linux s390x (archive sig / checksum / checksum sig / 8302ed012d4db63f69d878952e4c6ca56bd856683500d3af20452b8050df59d3)
• Windows amd64 (archive sig / checksum / checksum sig / 5fdbd28c8dc09770101deb73dc463773d6a9c02055e6892b04df8d7d3b8d2a04)

You can use a script to install on any system with bash.

Software Bill of Materials (SBOM)

You can download the SBOM for this release in SPDX format here. You can use bom to inspect the contents:

curl -sL -o sbom.spdx https://get.helm.sh/chartmuseum-v0.15.0.spdx
bom document outline sbom.spdx

The SBOM has also been uploaded to the registry alongside the image, and can be fetched using cosign:

cosign download sbom ghcr.io/helm/chartmuseum:v0.15.0 --output-file=sbom.spdx
bom document outline sbom.spdx

Digital Signatures

In this release, we have integrated with the sigstore project to produce digital signatures of container images.

To verify these signatures, you can use cosign.

Verify the container image:

COSIGN_EXPERIMENTAL=true cosign verify ghcr.io/helm/chartmuseum:v0.15.0 | jq .

Since the install script has used gpg in the past, signatures in this format have also been added (see .asc files attached to release). These were created with E97F 9DA5 AE2E 39CF 48A1 42B7 852A 7470 A39F B81D (@jdolitsky's GPG key) which can be found here and here.

What's Next

• 0.15.1 will contain only bug fixes.
• 0.16.0 is the next feature release.

Changelog

• Add support for building loong64 binaries (#599) 460d8ec (zhangwenlong)
• build(deps): bump github.com/stretchr/testify from 1.7.1 to 1.7.2 (#594) 7c965fa (dependabot[bot])
• build(deps): bump github.com/gin-gonic/gin from 1.8.0 to 1.8.1 (#595) 2de73d9 (dependabot[bot])
• feat: Prep for 0.15.0 release (#592) c61fe9c (Casey Buto)
• build(deps): bump github.com/spf13/viper from 1.11.0 to 1.12.0 (#587) ce8d0c7 (dependabot[bot])
• build(deps): bump github.com/chartmuseum/storage to v0.12.4 (#591) e52e480 (Casey Buto)
• chore: Add key (#590) 8a22b5a (Casey Buto)
• build(deps): bump github.com/gin-gonic/gin from 1.7.7 to 1.8.0 (#589) 17cca47 (dependabot[bot])
• feat: Add support for hosting an artifacthub-repo.yml file (#579) 68771af (Casey Buto)
• fix: fix typo (#588) a8efa0b (Zhizhen He)
• build(deps): bump helm.sh/helm/v3 from 3.8.2 to 3.9.0 (#585) f6f4cd7 (dependabot[bot])
• build(deps): bump github.com/prometheus/client_golang (#584) 043a8a4 (dependabot[bot])
• build(deps): bump github.com/urfave/cli from 1.22.8 to 1.22.9 (#582) ee6f03a (dependabot[bot])
• build(deps): bump github.com/urfave/cli from 1.22.7 to 1.22.8 (#580) ea22091 (dependabot[bot])
• build(deps): bump github.com/urfave/cli from 1.22.5 to 1.22.7 (#578) 9e0c2e3 (dependabot[bot])
• build(deps): bump github.com/spf13/viper from 1.10.1 to 1.11.0 (#577) a24309e (dependabot[bot])
• build(deps): bump helm.sh/helm/v3 from 3.8.1 to 3.8.2 (#576) 5e43197 (dependabot[bot])
• fix: Avoid data races for cacheEntries and index files (#556) bc596c0 (Casey Buto)
• pkg/chartmuseum: re-fmt import path (#573) 9790250 (Nace Sc)
• feature add chart template and value api (#551) 315ddf9 (zzhzero)
• build: bump Go to 1.17.8 (#571) b37d266 (Casey Buto)
• build(deps): bump github.com/stretchr/testify from 1.7.0 to 1.7.1 (#564) d884243 (dependabot[bot])
• feat: customize welcome page (#557) 1de4aa3 (Engin Diri)
• build(deps): bump helm.sh/helm/v3 from 3.8.0 to 3.8.1 (#561) c2b91a0 (dependabot[bot])
• ci: Add overwrite flag to deploy command for canary versions (#560) 29b831f (Casey Buto)
• Add nerdeveloper to OWNERS (#555) c91641a (Josh Dolitsky)
• refactor: remove disablemetrics for enablemetrics (#554) 49b460d (Obinna Odirionye)
• fix: Use the github API to get the latest release version (#553) ad07958 (Casey Buto)
• build(deps): bump go.uber.org/zap from 1.20.0 to 1.21.0 (#548) dff3e90 (dependabot[bot])
• ci: move building the go binaries outside of the Docker image to speed up builds (#544) 6fbfc6e (Casey Buto)
• fix: avoid panic with dynamic depth configured (#543) 20a3a09 (Casey Buto)