Skip to content

Conversation

@matthyx
Copy link

@matthyx matthyx commented Nov 21, 2025

Fix URL-encoded characters in asset filenames

Problem

Closes #281

Chart packages with SemVer build metadata (e.g., cloudbees-core-3.11627+2e5eff15bf01.tgz) cause chart-releaser to crash.

Root cause: GitHub encodes special characters in asset URLs (+%2B). When chart-releaser processes these URLs, it tries to access files using the encoded name (file%2Bversion.tgz) instead of the actual filename on disk (file+version.tgz), resulting in "file not found" errors.

Solution

This PR adds URL decoding at two critical points in the release processing pipeline:

  1. UpdateIndexFile() - Decodes the filename when extracting it from the asset URL
  2. addToIndexFile() - Decodes the filename when constructing the local file path

This ensures consistency between:

  • The URL representation (encoded)
  • The filesystem path (decoded)
  • The index file entry (decoded)

Changes

Core Implementation

  • Add url.PathUnescape() to decode filenames in UpdateIndexFile() (releaser.go:167-170)
  • Add url.PathUnescape() to decode filenames in addToIndexFile() (releaser.go:263-269)
  • Proper error handling with descriptive context for decode failures

Test Coverage

  • New test case: index-file-with-url-encoded-plus-sign
  • Test chart package with build metadata: test-chart-0.1.0+build.1.tgz
  • Comprehensive assertions verifying:
    • Chart is correctly found and processed
    • Index file contains the decoded version
    • Chart metadata is accurately preserved

Testing

All existing tests pass, plus new test coverage for URL encoding:

$ go test ./pkg/releaser
ok      github.com/helm/chart-releaser/pkg/releaser     0.016s

Fixes helm#281

GitHub encodes special characters in asset URLs (e.g., `+` becomes
`%2B`). When processing charts with SemVer build metadata like
`1.0.0+build.1`, chart-releaser would fail because it tried to access
files using the URL-encoded filename instead of the actual filename on
disk.

This change adds URL decoding in two critical locations:
- UpdateIndexFile(): when extracting filenames from asset URLs
- addToIndexFile(): when constructing local file paths

Both the filename used for filesystem operations and the name stored in
the index file are now properly decoded, ensuring consistency.

Added comprehensive test coverage including a test chart package with
build metadata to verify the fix works end-to-end.

Signed-off-by: Matthias Bertschy <[email protected]>
@matthyx matthyx force-pushed the fix/url-decode-asset-filenames branch from 1c72bf2 to b0c0bf7 Compare November 21, 2025 13:09
@matthyx
Copy link
Author

matthyx commented Dec 12, 2025

@cpanato can you have a look please?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

cr crashes as package version gets accidentially encoded

1 participant