pin dependencies

Signed-off-by: Roland.Ma <rolandma@yunify.com>

vendor/helm.sh/helm/v3/pkg/getter/getter.go

@@ -38,6 +38,7 @@ type options struct {
 	insecureSkipVerifyTLS bool
 	username              string
 	password              string
+	passCredentialsAll    bool
 	userAgent             string
 	version               string
 	registryClient        *registry.Client
@@ -64,6 +65,12 @@ func WithBasicAuth(username, password string) Option {
 	}
 }
 
+func WithPassCredentialsAll(pass bool) Option {
+	return func(opts *options) {
+		opts.passCredentialsAll = pass
+	}
+}
+
 // WithUserAgent sets the request's User-Agent header to use the provided agent name.
 func WithUserAgent(userAgent string) Option {
 	return func(opts *options) {

vendor/helm.sh/helm/v3/pkg/getter/httpgetter.go

@@ -20,6 +20,7 @@ import (
 	"crypto/tls"
 	"io"
 	"net/http"
+	"net/url"
 
 	"github.com/pkg/errors"
 
@@ -56,8 +57,24 @@ func (g *HTTPGetter) get(href string) (*bytes.Buffer, error) {
 		req.Header.Set("User-Agent", g.opts.userAgent)
 	}
 
-	if g.opts.username != "" && g.opts.password != "" {
-		req.SetBasicAuth(g.opts.username, g.opts.password)
+	// Before setting the basic auth credentials, make sure the URL associated
+	// with the basic auth is the one being fetched.
+	u1, err := url.Parse(g.opts.url)
+	if err != nil {
+		return buf, errors.Wrap(err, "Unable to parse getter URL")
+	}
+	u2, err := url.Parse(href)
+	if err != nil {
+		return buf, errors.Wrap(err, "Unable to parse URL getting from")
+	}
+
+	// Host on URL (returned from url.Parse) contains the port if present.
+	// This check ensures credentials are not passed between different
+	// services on different ports.
+	if g.opts.passCredentialsAll || (u1.Scheme == u2.Scheme && u1.Host == u2.Host) {
+		if g.opts.username != "" && g.opts.password != "" {
+			req.SetBasicAuth(g.opts.username, g.opts.password)
+		}
 	}
 
 	client, err := g.httpClient()

vendor/helm.sh/helm/v3/pkg/getter/ocigetter.go

@@ -58,10 +58,19 @@ func (g *OCIGetter) get(href string) (*bytes.Buffer, error) {
 }
 
 // NewOCIGetter constructs a valid http/https client as a Getter
-func NewOCIGetter(options ...Option) (Getter, error) {
-	var client OCIGetter
+func NewOCIGetter(ops ...Option) (Getter, error) {
+	registryClient, err := registry.NewClient()
+	if err != nil {
+		return nil, err
+	}
 
-	for _, opt := range options {
+	client := OCIGetter{
+		opts: options{
+			registryClient: registryClient,
+		},
+	}
+
+	for _, opt := range ops {
 		opt(&client.opts)
 	}