Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

OCIRepository: pick the Helm chart layer automatically when the first layer is a provenance file

Open Beginner friendly
  • Is something wrong?
#2,198 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@rg3122 is already working on this.

Since Oct 23, 2026.

  • #2205 by @rg3122 — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
go
Domain
backend, infrastructure

Research direction

Start in internal/controller/ocirepository_controller.go at selectLayer, especially the default branch, and read the existing layer selection tests. Add a test artifact with the provenance layer first and confirm the chart content layer is selected when no selector is set. Done means the default handles that order while explicit layer selectors retain precedence.

Written by the indexing model from the issue text.

Description

How we ran into it

We were bootstrapping a new cluster and reused the CloudNativePG setup from another cluster that has been running for two months: an OCIRepository for oci://ghcr.io/cloudnative-pg/charts/cloudnative-pg pinned to 0.29.0 plus a HelmRelease with chartRef. The only change was a patch bump of the tag to 0.29.1. The source immediately went to:

failed to extract layer contents from artifact: requires gzip-compressed body: gzip: invalid header

Both versions are signed and carry the same two layers. The only difference is their order:

0.29.0
  application/vnd.cncf.helm.chart.content.v1.tar+gzip   201392
  application/vnd.cncf.helm.chart.provenance.v1.prov      1625
0.29.1
  application/vnd.cncf.helm.chart.provenance.v1.prov      1625
  application/vnd.cncf.helm.chart.content.v1.tar+gzip   205129

So a patch release of an upstream chart broke a config that had been working for two months, and nothing on our side changed.

Current behaviour

Without spec.layerSelector, selectLayer always takes layers[0]:

https://github.com/fluxcd/source-controller/blob/effd29b2da5be2ffc4fa99d99a4b2e87f08e5e84/internal/controller/ocirepository_controller.go#L594-L632

When layers[0] is the .prov layer, extraction always fails. The documented fix is to set layerSelector.mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip, and that does fix it. Still, it keeps coming up as a bug report, because signed charts (Helm 4, cosign v3) put the provenance layer first and the error doesn't point to the cause:

  • #1847: dynatrace-operator 1.6.0
  • #1932: traefik 37.2.0
  • fluxcd/flux2#5788: cloudnative-pg/plugin-barman-cloud

In fluxcd/flux2#5788 the answer to "why isn't this the default?" was that defaults can't change in GA software and that OCIRepository is meant for any artifact type, first of all Flux's own. I agree with both points. I think the change below doesn't conflict with either of them.

Proposal

Only touch the default: branch, i.e. the case where no layer selector is set:

  • if layers[0] has media type application/vnd.cncf.helm.chart.provenance.v1.prov (registry.ProvLayerMediaType in Helm),
  • then pick the first layer with application/vnd.cncf.helm.chart.content.v1.tar+gzip (registry.ChartLayerMediaType) instead,
  • and leave the operation at the default (extract), same as today.

Alternatively, the check could key off the manifest config media type application/vnd.cncf.helm.config.v1+json. Either is fine with me; the provenance check is the narrower one.

Why this is safe for existing users

  • Charts that work today have the chart layer first. They hit exactly the same layer with the same operation, so artifact, revision and digest are identical. Nothing changes for them.
  • Charts with the provenance layer first fail with a hard error today. That is the only case whose behaviour changes, and it changes from "always broken" to "works". It's hard to imagine anyone relying on that error.
  • Flux artifacts and any other non-Helm artifacts are untouched: their config is application/vnd.cncf.flux.config.v1+json and their layers are never .prov.
  • An explicit layerSelector keeps full precedence, as today.

It is a trivial change: a few lines in selectLayer plus a test with a provenance-first artifact. No API change, no new field, no change to existing artifacts. I'm happy to send the PR if the maintainers agree with the approach.

Out of scope

The _ ↔ + tag mapping for ref.semver (convertOCIToSemVerTag) is also tied to layerSelector.mediaType, and it runs before the manifest is fetched, so autodetection can't cover it. Users with semver ranges over tags like 1.2.3_build.1 would still need the explicit selector. I'd keep that out of this issue on purpose.

Dominant language
Go
Stars
285
Forks
259
Avg merge
2d 14h
Merged PRs (30d)
16

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from fluxcd/source-controller

All issues in fluxcd/source-controller

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.