Installation and signature verification

Installation

By downloading binary from the release

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/carvel-dev/kbld/releases/download/v0.45.1/kbld-linux-amd64

# Move the binary in to your PATH
mv kapp-linux-amd64 /usr/local/bin/kbld

# Make the binary executable
chmod +x /usr/local/bin/kbld

Via Homebrew (macOS or Linux)

$ brew tap carvel-dev/carvel
$ brew install kbld
$ kbld version

Verify checksums file signature

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC(Refer this page for cosign installation). To validate the signature of this file, run the following commands:

# Download the checksums file, certificate and signature
curl -LO https://github.com/carvel-dev/kbld/releases/download/v0.45.1/checksums.txt
curl -LO https://github.com/carvel-dev/kbld/releases/download/v0.45.1/checksums.txt.pem
curl -LO https://github.com/carvel-dev/kbld/releases/download/v0.45.1/checksums.txt.sig

# Verify the checksums file
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp=https://github.com/carvel-dev \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com

Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature.

# Verify the binary using the checksums file
sha256sum -c checksums.txt --ignore-missing

✨ What's new

Bump golang to 1.23.7 and fix CVEs by @devanshuVmware in #537

Full Changelog: v0.45.0...v0.45.1

📂 Files Checksum

0f0958196d515e16b0f4ca7d6f4578e49c0e39dd1a9361c5f57859e67ff13528  ./kbld-windows-arm64.exe
19c59f016a55007093f720af51a890eed65798c293fa798d5ef98be7b170e59d  ./kbld-linux-arm64
467647ee291321e2eca0a8002a5bc65fe4dd61af1d461861cd20bde8f542950c  ./kbld-windows-amd64.exe
4d96f3c2723da903fece06ece0ee49f21db6c5d125a32e3b74c00a680c0fdfe3  ./kbld-darwin-amd64
9393c678bf03cd6559ef7df4a93507ece934a63779526a97ad632b0a265ec5c8  ./kbld-linux-amd64
afbf0dc8524e8d3b1780ec0cffeb54ab75b87ea3e1531b5b31769c94f5d4105d  ./kbld-darwin-arm64

carvel-dev/kbld v0.45.1 on GitHub