Trivy currently parses Helm chart archives manually (parser_tar.go). Switching to the Helm v4 SDK loaders (LoadArchive, LoadDir) offloads chart version detection to the SDK — which is a prerequisite for Charts v3 support.
Scope
- Replace custom tar parsing in parser_tar.go with
loader.LoadArchive
- Convert the resulting
*chart.Chart into Trivy's mapfs.FS for downstream scanning
- Verify existing test coverage still passes
References
Trivy currently parses Helm chart archives manually (
parser_tar.go). Switching to the Helm v4 SDK loaders (LoadArchive,LoadDir) offloads chart version detection to the SDK — which is a prerequisite for Charts v3 support.Scope
loader.LoadArchive*chart.Chartinto Trivy'smapfs.FSfor downstream scanningReferences