{"record":{"id":"003ac7e544a6fb10","repo":"helm/helm","slug":"missing-registry-client-w","errorCode":null,"errorMessage":"missing registry client: %w","messagePattern":"missing registry client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cmd/dependency_build.go","lineNumber":65,"sourceCode":"\n\tcmd := &cobra.Command{\n\t\tUse:   \"build CHART\",\n\t\tShort: \"rebuild the charts/ directory based on the Chart.lock file\",\n\t\tLong:  dependencyBuildDesc,\n\t\tArgs:  require.MaximumNArgs(1),\n\t\tRunE: func(_ *cobra.Command, args []string) error {\n\t\t\tchartpath := \".\"\n\t\t\tif len(args) > 0 {\n\t\t\t\tchartpath = filepath.Clean(args[0])\n\t\t\t}\n\t\t\tsourceDateEpoch, err := sourceDateEpochFromEnv()\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tregistryClient, err := newRegistryClient(out, client.CertFile, client.KeyFile, client.CaFile,\n\t\t\t\tclient.InsecureSkipTLSVerify, client.PlainHTTP, client.Username, client.Password)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"missing registry client: %w\", err)\n\t\t\t}\n\n\t\t\tman := &downloader.Manager{\n\t\t\t\tOut:              out,\n\t\t\t\tChartPath:        chartpath,\n\t\t\t\tKeyring:          client.Keyring,\n\t\t\t\tSkipUpdate:       client.SkipRefresh,\n\t\t\t\tGetters:          getter.All(settings),\n\t\t\t\tRegistryClient:   registryClient,\n\t\t\t\tRepositoryConfig: settings.RepositoryConfig,\n\t\t\t\tRepositoryCache:  settings.RepositoryCache,\n\t\t\t\tContentCache:     settings.ContentCache,\n\t\t\t\tDebug:            settings.Debug,\n\t\t\t\tSourceDateEpoch:  sourceDateEpoch,\n\t\t\t}\n\t\t\tif client.Verify {\n\t\t\t\tman.Verify = downloader.VerifyIfPossible\n\t\t\t}","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/helm/helm/blob/2a29f1770b62844b27197d2507377361d45ad7c0/pkg/cmd/dependency_build.go#L47-L83","documentation":"Returned by `helm dependency build` when newRegistryClient fails to construct the OCI registry client. Despite the wording, a client is always attempted — construction fails because TLS material could not be assembled (--cert-file/--key-file pair or --ca-file unreadable/invalid → 'can't create TLS config for client') or registry.NewClient rejected options such as an unusable credentials file at HELM_REGISTRY_CONFIG. The underlying cause is chained via %w.","triggerScenarios":"helm dependency build --ca-file /missing/ca.crt; --cert-file/--key-file where only one of the pair is given with a caFile but files are malformed; HELM_REGISTRY_CONFIG pointing to a corrupt or unreadable JSON credentials file; permission errors reading client TLS files.","commonSituations":"Private registry setups in CI passing stale cert paths after secret rotation; containers missing mounted TLS secrets; HELM_REGISTRY_CONFIG pointed at a directory or empty invalid file; expired client certificates that no longer parse.","solutions":["Read the wrapped error — 'can't create TLS config for client' means bad/unreadable --cert-file/--key-file/--ca-file","Verify each TLS file exists and parses: openssl x509 -in ca.crt -noout (and similar for key pair)","Check HELM_REGISTRY_CONFIG (default ~/.config/helm/registry.json) is a readable, valid file","Retest with the TLS flags omitted to isolate whether flags or the credentials file is at fault"],"exampleFix":"# before\n$ helm dependency build --ca-file ./certs/old-ca.pem\nError: missing registry client: can't create TLS config for client: open ./certs/old-ca.pem: no such file or directory\n\n# after\n$ openssl x509 -in ./certs/ca.pem -noout # verify it exists/parses\n$ helm dependency build --ca-file ./certs/ca.pem","handlingStrategy":"validation","validationCode":"for _, f := range []string{client.CertFile, client.KeyFile, client.CaFile} {\n\tif f == \"\" { continue }\n\tif _, err := os.Stat(f); err != nil {\n\t\treturn fmt.Errorf(\"TLS file %s unusable: %w\", f, err)\n\t}\n}","typeGuard":null,"tryCatchPattern":"if err := buildCmd.Execute(); err != nil {\n\tif strings.Contains(err.Error(), \"missing registry client\") {\n\t\t// unwrap chain: TLS config error → fix cert/key/ca files; otherwise check registry credentials file\n\t}\n}","preventionTips":["Verify --cert-file/--key-file/--ca-file exist and parse (openssl) before each run","Supply client certs as a matched pair","Keep HELM_REGISTRY_CONFIG on a valid, readable path","Mount TLS secrets into CI containers at fixed, tested paths"],"tags":["registry","oci","tls","dependencies","cli","certificates"],"backgroundTag":null,"analyzedSha":"2a29f1770b62844b27197d2507377361d45ad7c0","analyzedAt":"2026-08-15T22:02:47.490Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}