Add support for OCI registries (#402)

.nancy-ignore

@@ -1,3 +1,26 @@
-# Affects all versions of archiver which is required by vault.
-# Taken from: https://github.com/giantswarm/opsctl/pull/1072/files#diff-bbe4a7fb12c43622bce7c6840c770e9995be614626a219942ca138403629cb69R1
-CVE-2019-10743 until=2021-10-17
+# Vulerabilities for k8s.io/kubernetes v1.13.0. It's a dependency of helm v3.8.1.
+CVE-2018-1002102 until=2022-06-01
+CVE-2019-1002100 until=2022-06-01
+CVE-2019-1002101 until=2022-06-01
+CVE-2019-11243   until=2022-06-01
+CVE-2019-11244   until=2022-06-01
+CVE-2019-11246   until=2022-06-01
+CVE-2019-11247   until=2022-06-01
+CVE-2019-11248   until=2022-06-01
+CVE-2019-11249   until=2022-06-01
+CVE-2019-11250   until=2022-06-01
+CVE-2019-11251   until=2022-06-01
+CVE-2019-11253   until=2022-06-01
+CVE-2019-11254   until=2022-06-01
+CVE-2019-9946    until=2022-06-01
+CVE-2020-8552    until=2022-06-01
+CVE-2020-8555    until=2022-06-01
+CVE-2020-8557    until=2022-06-01
+CVE-2020-8558    until=2022-06-01
+CVE-2020-8559    until=2022-06-01
+CVE-2020-8563    until=2022-06-01
+CVE-2021-25735   until=2022-06-01
+CVE-2021-25741   until=2022-06-01
+# Warnings for k8s.io/kubernetes v1.13.0
+3f9f4830-26e4-4acd-915b-448d38934e43 until=2022-06-01
+7a182d40-9217-4391-85e9-6c44219efa7a until=2022-06-01

CHANGELOG.md

@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Add support for OCI charts.
+
+### Changed
+
+- Update Helm to v3.8.1
+
 ## [4.9.0] - 2021-12-13
 
 ### Changed

go.mod

@@ -9,13 +9,15 @@ require (
 	github.com/giantswarm/micrologger v0.6.0
 	github.com/google/go-cmp v0.5.6
 	github.com/mholt/archiver/v3 v3.5.0
+	github.com/opencontainers/image-spec v1.0.2
 	github.com/prometheus/client_golang v1.11.0
 	github.com/spf13/afero v1.6.0
-	helm.sh/helm/v3 v3.6.3
-	k8s.io/api v0.21.4
-	k8s.io/apimachinery v0.21.4
-	k8s.io/client-go v0.21.4
-	sigs.k8s.io/controller-runtime v0.9.7
+	helm.sh/helm/v3 v3.8.1
+	k8s.io/api v0.23.5
+	k8s.io/apimachinery v0.23.5
+	k8s.io/client-go v0.23.5
+	oras.land/oras-go v1.1.0
+	sigs.k8s.io/controller-runtime v0.11.2
 )
 
 replace (