Cannot create Application with sha256 image digest value for OCI-packaged Helm charts

[pgodowski]

Checklist:

• I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• I've included steps to reproduce the bug.
• I've pasted the output of argocd version.

Describe the bug

Using ArgoCD v3.1.8, I am trying to deploy Helm chart packaged as OCI artifact stored in the container registry, by using the image sha256 digest value in targetRevision, Argo fails to create Application.

ArgoCD fails with same error as mentioned #23580, which is supposedly fixed in v3.1.8 already though:

Unable to save changes: application spec for nginx-oci-app is invalid:
InvalidSpecError: Unable to generate manifests in : 
rpc error: code = Unknown desc = invalid revision:
failed to determine semver constraint: improper constraint: 
sha256:4b5007efa6ea560d18fb7cb7d4f268e180ef8f8e577861abeb8db38ad39a49eb

To Reproduce

This fails:

• There is container registry with Helm chart packaged as OCI artifacts at example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com/piotr/charts.

• There is Helm chart test-nginx-chart/nginx, with image tag 22.0.11 and digest sha256:4b5007efa6ea560d18fb7cb7d4f268e180ef8f8e577861abeb8db38ad39a49eb

• Argo is configured with this repository

- connectionState:
    attemptedAt: "2025-10-15T12:26:59Z"
    message: ""
    status: Successful
  enableOCI: true
  name: quay-oci-repo
  repo: example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com/piotr/charts
  type: helm

• This fails

project: default
source:
  repoURL: >-
    example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com/piotr/charts
  targetRevision: sha256:4b5007efa6ea560d18fb7cb7d4f268e180ef8f8e577861abeb8db38ad39a49eb
  chart: test-nginx-chart/nginx
destination:
  server: https://kubernetes.default.svc/
  namespace: nginx-demo
syncPolicy:
  automated:
    prune: true
    selfHeal: true

with error

Unable to save changes: application spec for nginx-oci-app is invalid:
InvalidSpecError: Unable to generate manifests in : 
rpc error: code = Unknown desc = invalid revision:
failed to determine semver constraint: improper constraint: 
sha256:4b5007efa6ea560d18fb7cb7d4f268e180ef8f8e577861abeb8db38ad39a49eb

• This works though

project: default
source:
  repoURL: >-
    example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com/piotr/charts
  targetRevision: 22.0.11
  chart: test-nginx-chart/nginx
destination:
  server: https://kubernetes.default.svc/
  namespace: nginx-demo
syncPolicy:
  automated:
    prune: true
    selfHeal: true

Expected behavior

Argo successfully create Application and deploys Helm chart packaged as OCI image and pulled the specific image digest from the container registry.

Screenshots

Version

argocd: v3.1.8+becb020
  BuildDate: 2025-09-30T16:04:21Z
  GitCommit: becb020064fe9be5381bf6e5818ff8587ca8f377
  GitTreeState: clean
  GoVersion: go1.24.6
  Compiler: gc
  Platform: linux/amd64
argocd-server: v3.1.8+becb020
  BuildDate: 2025-09-30T15:33:46Z
  GitCommit: becb020064fe9be5381bf6e5818ff8587ca8f377
  GitTreeState: clean
  GoVersion: go1.24.6
  Compiler: gc
  Platform: linux/amd64
  Kustomize Version: v5.7.0 2025-06-28T07:00:07Z
  Helm Version: v3.18.4+gd80839c
  Kubectl Version: v0.33.1
  Jsonnet Version: v0.21.0

Logs

time="2025-10-15T15:42:12Z" level=info msg="started call" grpc.component=server grpc.method=TestRepository grpc.method_type=unary grpc.request.deadline="2025-10-15T15:43:12Z" grpc.service=repository.RepoServerService grpc.start_time="2025-10-15T15:42:12Z" grpc.time_ms=0.057 peer.address="10.244.0.101:36334" protocol=grpc
time="2025-10-15T15:42:12Z" level=info msg="helm registry login example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com/piotr/charts --username ****** --password ****** --ca-file /app/config/tls/example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com" dir=/tmp/helm1853470485 execID=8d9e3
time="2025-10-15T15:42:13Z" level=info msg=Trace args="[helm registry login example-registry-quay-openshift-operators.apps.quay-gori.cp.example.comm/piotr/charts --username ****** --password ****** --ca-file /app/config/tls/example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com]" dir=/tmp/helm1853470485 operation_name="exec helm" time_ms=752.7489840000001
time="2025-10-15T15:42:13Z" level=info msg="took to test helm oci repository" seconds=0.754114189
time="2025-10-15T15:42:13Z" level=info msg="helm registry logout example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com/piotr/charts" dir=/tmp/helm1853470485 execID=6f659
time="2025-10-15T15:42:13Z" level=info msg=Trace args="[helm registry logout example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com/piotr/charts]" dir=/tmp/helm1853470485 operation_name="exec helm" time_ms=174.686344
time="2025-10-15T15:42:13Z" level=info msg="finished call" grpc.code=OK grpc.component=server grpc.method=TestRepository grpc.method_type=unary grpc.request.deadline="2025-10-15T15:43:12Z" grpc.service=repository.RepoServerService grpc.start_time="2025-10-15T15:42:12Z" grpc.time_ms=932.067 peer.address="10.244.0.101:36334" protocol=grpc
time="2025-10-15T15:42:13Z" level=info msg="started call" grpc.component=server grpc.method=GenerateManifest grpc.method_type=unary grpc.request.deadline="2025-10-15T15:43:13Z" grpc.service=repository.RepoServerService grpc.start_time="2025-10-15T15:42:13Z" grpc.time_ms=0.018 peer.address="10.244.0.101:36334" protocol=grpc
time="2025-10-15T15:42:14Z" level=info msg="took to get tags" chart=test-nginx-chart/nginx repo=example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com/piotr/charts seconds=0.40343942
time="2025-10-15T15:42:14Z" level=error msg="finished call" grpc.code=Unknown grpc.component=server grpc.error="invalid revision: failed to determine semver constraint: improper constraint: sha256:4b5007efa6ea560d18fb7cb7d4f268e180ef8f8e577861abeb8db38ad39a49eb" grpc.method=GenerateManifest grpc.method_type=unary grpc.request.deadline="2025-10-15T15:43:13Z" grpc.service=repository.RepoServerService grpc.start_time="2025-10-15T15:42:13Z" grpc.time_ms=410.865 peer.address="10.244.0.101:36334" protocol=grpc
time="2025-10-15T15:42:21Z" level=info msg="started call" grpc.component=server grpc.method=Check grpc.method_type=unary grpc.request.deadline="2025-10-15T15:43:21Z" grpc.service=grpc.health.v1.Health grpc.start_time="2025-10-15T15:42:21Z" grpc.time_ms=0.021 peer.address="[::1]:55372" protocol=grpc

[pgodowski]

@blakepettersson
but also @sabre1041 (long time no talk) I see you are active in the space of Argo/Helm private OCI repositories - can you please provide some guidance on what I am doing wrong?

[blakepettersson]

@pgodowski you need to prefix your repoURL with oci://, so oci://example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com/piotr/charts

[pgodowski]

I need to play more with this. Indeed it worked fine, but when I added repository with the full path to the OCI-packaged image, i.e. I added oci://example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com/piotr/charts/test-nginx-chart/nginx and then I created this Application:

project: default
source:
  repoURL: >-
    oci://example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com/piotr/charts/test-nginx-chart/nginx
  path: .
  targetRevision: sha256:4b5007efa6ea560d18fb7cb7d4f268e180ef8f8e577861abeb8db38ad39a49eb
destination:
  server: https://kubernetes.default.svc
  namespace: default

but then when I added into Argo the repository like:
oci://example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com/piotr/charts
which has a lot of images there, like:
test-nginx-chart/nginx:22.0.11
openshift-console-plugin:0.1.0

I am not able to construct working Application CR:

project: default
source:
  repoURL: >-
    oci://example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com/piotr/charts/openshift-console-plugin
  path: .
  targetRevision: sha256:5dd1328526a5de7577ace7b6734e6b5b4f4d2c52a7013461559d598336b67fe5
destination:
  server: https://kubernetes.default.svc
  namespace: default

Unable to save changes: application spec for test-nginx-oci2 is invalid: InvalidSpecError:
repository not accessible: repositories not accessible:
&Repository{Repo:
"oci://example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com/piotr/charts/openshift-console-plugin", Type: "", Name: "", Project: ""}:
repo client error while testing repository: rpc error: code = Unknown desc =
error testing repository connectivity:
GET "https://example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com/v2/":
GET "https://example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com/v2/auth?service=example-registry-quay-openshift-operators.apps.quay-gori.cp.example.com": response status code 401: unauthorized: access to the requested resource is not authorized: map[]

Should I add EVERY helm chart packaged as OCI as a repository into Argo server?

[blakepettersson]

It's either that or create a repository template where you have a single secret where a repourl prefix can be shared for all Helm charts