Helm Client Security Fix (Moderate)

## v2.12.2 Helm v2.12.2 is a **security release**. This release contains a security fix for a vulnerability described [here](https://helm.sh/blog/helm-security-notice-2019/index.html). **Users are strongly recommended to update.** The community keeps growing, and we'd love to see you there! - Join the discussion in [Kubernetes Slack](https://kubernetes.slack.com): - `#helm-users` for questions and just to hang out - `#helm-dev` for discussing PRs, code, and bugs - Hang out at the Public Developer Call: Thursday, 9:30 Pacific via [Zoom](https://zoom.us/j/696660622) - Test, debug, and contribute charts: [GitHub/helm/charts](https://github.com/helm/charts) ## Features and Changes This release fixes a security issue. A malicious chart can cause the commands `helm fetch --unpack` and `helm lint` to unpack chart content outside of the chart directory on the local filesystem. Tiller is not impacted. ## Installation and Upgrading Download Helm 2.12.2. The common platform binaries are here: - [MacOS amd64](https://get.helm.sh/helm-v2.12.2-darwin-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v2.12.2-darwin-amd64.tar.gz.sha256)) - [Linux amd64](https://get.helm.sh/helm-v2.12.2-linux-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v2.12.2-linux-amd64.tar.gz.sha256)) - [Linux arm](https://get.helm.sh/helm-v2.12.2-linux-arm.tar.gz) ([checksum](https://get.helm.sh/helm-v2.12.2-linux-arm.tar.gz.sha256)) - [Linux arm64](https://get.helm.sh/helm-v2.12.2-linux-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v2.12.2-linux-arm64.tar.gz.sha256)) - [Linux i386](https://get.helm.sh/helm-v2.12.2-linux-386.tar.gz) ([checksum](https://get.helm.sh/helm-v2.12.2-linux-386.tar.gz.sha256)) - [Linux ppc64le](https://get.helm.sh/helm-v2.12.2-linux-ppc64le.tar.gz) ([checksum](https://get.helm.sh/helm-v2.12.2-linux-ppc64le.tar.gz.sha256)) - [Linux s390x](https://get.helm.sh/helm-v2.12.2-linux-s390x.tar.gz) ([checksum](https://get.helm.sh/helm-v2.12.2-linux-s390x.tar.gz.sha256)) - [Windows amd64](https://get.helm.sh/helm-v2.12.2-windows-amd64.zip) ([checksum](https://get.helm.sh/helm-v2.12.2-windows-amd64.zip.sha256)) Once you have the client installed, upgrade Tiller with `helm init --upgrade`. The [Quickstart Guide](https://docs.helm.sh/using_helm/#quickstart-guide) will get you going from there. For **upgrade instructions** or detailed installation notes, check the [install guide](https://docs.helm.sh/using_helm/#installing-helm). You can also use a [script to install](https://raw.githubusercontent.com/helm/helm/master/scripts/get) on any system with `bash`. ## What's Next - v2.12.3 will contain only bug fixes. - v2.13.0 is the next feature release. ## Changelog - fix: perform extra validation on paths in tar archives (#5165) c194e4a4016902e2ab3f06b29dc8628f27d971a4 (Matt Butcher)