Repository: helm/helm
File: pkg/downloader/chart_downloader.go (Go)

Code before:
				slog.Debug("found chart in cache", "id", hash)
			}
		}
	}

	if !found {
		c.Options = append(c.Options, getter.WithAcceptHeader("application/gzip,application/octet-stream"))

		data, err = g.Get(u.String(), c.Options...)
		if err != nil {
			return "", nil, err
		}
	}

	name := filepath.Base(u.Path)
	if u.Scheme == registry.OCIScheme {
		idx := strings.LastIndexByte(name, ':')
		name = fmt.Sprintf("%s-%s.tgz", name[:idx], name[idx+1:])
	}

	destfile := filepath.Join(dest, name)

	// Use LockedAtomicWriteFile to handle concurrent writes safely
	// This prevents "Access Denied" errors on Windows when multiple processes
	// try to write to the same file simultaneously
	if _, err := fileutil.LockedAtomicWriteFile(destfile, data, 0644); err != nil {
		return destfile, nil, err
	}

	// If provenance is requested, verify it.
	ver := &provenance.Verification{}
	if c.Verify > VerifyNever {
		found = false
		var body *bytes.Buffer
		if hash != "" {
			if pth, err := c.Cache.Get(digest32, CacheProv); err == nil {
				fdata, err := os.ReadFile(pth)
				if err == nil {
					found = true
					body = bytes.NewBuffer(fdata)
					slog.Debug("found provenance in cache", "id", hash)
				}
			}
		}
		if !found {
			body, err = g.Get(u.String() + ".prov")
			if err != nil {
				if c.Verify == VerifyAlways {
					return destfile, ver, fmt.Errorf("failed to fetch provenance %q", u.String()+".prov")
				}
				fmt.Fprintf(c.Out, "WARNING: Verification not found for %s: %s\n", ref, err)

Review comment (suggestion):
I don't think we should change the behavior on non-windows. Linux (for example) doesn't have the problem mention in https://github.com/helm/helm/issues/31633 I believe.

To do this, build target specific tags would/should be used. ref: https://go.dev/wiki/TargetSpecific

Code after:
				slog.Debug("found chart in cache", "id", hash)
			}
		}
	}

	if !found {
		c.Options = append(c.Options, getter.WithAcceptHeader("application/gzip,application/octet-stream"))

		data, err = g.Get(u.String(), c.Options...)
		if err != nil {
			return "", nil, err
		}
	}

	name := filepath.Base(u.Path)
	if u.Scheme == registry.OCIScheme {
		idx := strings.LastIndexByte(name, ':')
		name = fmt.Sprintf("%s-%s.tgz", name[:idx], name[idx+1:])
	}

	destfile := filepath.Join(dest, name)

	// Use PlatformAtomicWriteFile to handle platform-specific concurrency concerns
	// (Windows requires locking to avoid "Access Denied" errors when multiple
	// processes write the same file)
	if err := fileutil.PlatformAtomicWriteFile(destfile, data, 0644); err != nil {
		return destfile, nil, err
	}

	// If provenance is requested, verify it.
	ver := &provenance.Verification{}
	if c.Verify > VerifyNever {
		found = false
		var body *bytes.Buffer
		if hash != "" {
			if pth, err := c.Cache.Get(digest32, CacheProv); err == nil {
				fdata, err := os.ReadFile(pth)
				if err == nil {
					found = true
					body = bytes.NewBuffer(fdata)
					slog.Debug("found provenance in cache", "id", hash)
				}
			}
		}
		if !found {
			body, err = g.Get(u.String() + ".prov")
			if err != nil {
				if c.Verify == VerifyAlways {
					return destfile, ver, fmt.Errorf("failed to fetch provenance %q", u.String()+".prov")
				}
				fmt.Fprintf(c.Out, "WARNING: Verification not found for %s: %s\n", ref, err)