Installation and signature verification

Installation

By downloading binary from the release

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/carvel-dev/imgpkg/releases/download/v0.47.3/imgpkg-linux-amd64

# Move the binary in to your PATH
mv imgpkg-linux-amd64 /usr/local/bin/imgpkg

# Make the binary executable
chmod +x /usr/local/bin/imgpkg

Via Homebrew (macOS or Linux)

$ brew tap carvel-dev/carvel
$ brew install imgpkg
$ imgpkg version

Verify checksums file signature

Install cosign on your system https://docs.sigstore.dev/system_config/installation/

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:

# Download the checksums file, certificate and signature
curl -LO https://github.com/carvel-dev/imgpkg/releases/download/v0.47.3/checksums.txt
curl -LO https://github.com/carvel-dev/imgpkg/releases/download/v0.47.3/checksums.txt.pem
curl -LO https://github.com/carvel-dev/imgpkg/releases/download/v0.47.3/checksums.txt.sig

# Verify the checksums file
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp=https://github.com/carvel-dev \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com

Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature.

# Verify the binary using the checksums file
sha256sum -c checksums.txt --ignore-missing

What's Changed

Bump go by @praveenrewar in #782

Full Changelog: v0.47.2...v0.47.3

📂 Files Checksum

10bff19e58edbbb082f368082dae350f9862c5a79e218bdcc960ade4722a047c  ./imgpkg-linux-amd64
7a6d10d4156bcf356cd2211d16691493625861a599a69e0ae116f0c4873f773a  ./imgpkg-windows-amd64.exe
8209b6f91c6c80d24ede0c5a7b0911fc9b383d22e4809738f3fcd862e08cbf32  ./imgpkg-linux-arm64
b18776b011bc8b6e81eb2e03d4fd373daa164154885d1b3a03c6abf1b1bb84fe  ./imgpkg-darwin-amd64
e78fa326f7932f8e8a1fa7da5dec0762b8838f0fb8df96d7651c2f81ddf57a8d  ./imgpkg-darwin-arm64

carvel-dev/imgpkg v0.47.3 on GitHub