Installation and signature verification

Installation

By downloading binary from the release

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/carvel-dev/imgpkg/releases/download/v0.47.0/imgpkg-linux-amd64

# Move the binary in to your PATH
mv imgpkg-linux-amd64 /usr/local/bin/imgpkg

# Make the binary executable
chmod +x /usr/local/bin/imgpkg

Via Homebrew (macOS or Linux)

$ brew tap carvel-dev/carvel
$ brew install imgpkg
$ imgpkg version

Verify checksums file signature

Install cosign on your system https://docs.sigstore.dev/system_config/installation/

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:

# Download the checksums file, certificate and signature
curl -LO https://github.com/carvel-dev/imgpkg/releases/download/v0.47.0/checksums.txt
curl -LO https://github.com/carvel-dev/imgpkg/releases/download/v0.47.0/checksums.txt.pem
curl -LO https://github.com/carvel-dev/imgpkg/releases/download/v0.47.0/checksums.txt.sig

# Verify the checksums file
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp=https://github.com/carvel-dev \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com

Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature.

# Verify the binary using the checksums file
sha256sum -c checksums.txt --ignore-missing

What's Changed

Allow shallow-copy of a bundle by @rosenhouse in #758
Add layer and image size information to describe command by @mdzhigarov in #760
Bump golang.org/x/sys from 0.32.0 to 0.33.0 by @dependabot in #740
Bump golang.org/x/sync from 0.13.0 to 0.14.0 by @dependabot in #741
Bump golang to 1.24.9 by @devanshuVmware in #759

New Contributors

@rosenhouse made their first contribution in #758

Full Changelog: v0.46.0...v0.47.0

📂 Files Checksum

14d0083027eeba54a4804c561fb41d0c723f908ec91e073e88f3a64c52b54544  ./imgpkg-linux-arm64
465b4843ae762c6a693fffe250a13bef37536cf6fd218d791165a919214447c5  ./imgpkg-darwin-arm64
5e03036ecc48c3385618f6020bad13554493019dbb472062f6ccab28e4b01162  ./imgpkg-darwin-amd64
754abc5ed6d3dcab5791107ed355e10ba30041ba8ede1f5d94b9a733c71eae48  ./imgpkg-windows-amd64.exe
7602b6af24a818265dcb2cc0dc7f6117a3591f26e2c266f294800f99ae433da1  ./imgpkg-linux-amd64

carvel-dev/imgpkg v0.47.0 on GitHub