v0.40.0

Installation and signature verification

Installation

By downloading binary from the release

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/carvel-dev/imgpkg/releases/download/v0.40.0/imgpkg-linux-amd64

# Move the binary in to your PATH
mv imgpkg-linux-amd64 /usr/local/bin/imgpkg

# Make the binary executable
chmod +x /usr/local/bin/imgpkg

Via Homebrew (macOS or Linux)

$ brew tap carvel-dev/carvel
$ brew install imgpkg
$ imgpkg version

Verify checksums file signature

Install cosign on your system https://docs.sigstore.dev/system_config/installation/

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:

# Download the checksums file, certificate and signature
curl -LO https://github.com/carvel-dev/imgpkg/releases/download/v0.40.0/checksums.txt
curl -LO https://github.com/carvel-dev/imgpkg/releases/download/v0.40.0/checksums.txt.pem
curl -LO https://github.com/carvel-dev/imgpkg/releases/download/v0.40.0/checksums.txt.sig

# Verify the checksums file
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp=https://github.com/carvel-dev \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com

Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature.

# Verify the binary using the checksums file
sha256sum -c checksums.txt --ignore-missing

What's Changed

• Add imgpkg-session-id to http headers by @joaopapereira in #600
• Use logger that always write on describe command by @joaopapereira in #599
• Updated describe command to show layer's digest of each image by @kumaritanushree in #622
• Signing and verification added, release notes generation automated by @rcmadhankumar in #627
• Bump go version to 1.21.6 by @sethiyash in #628

Full Changelog: v0.39.0...v0.40.0

📂 Files Checksum

4da669ff323d950d8dce5bf6b5a760336005567fe1643c01c811bad43d8d2ca1  ./imgpkg-windows-amd64.exe
670b98c5c5b24ae20101b3ab2c430bf2340a9d47b21257b08c8ead20b207e615  ./imgpkg-linux-arm64
76eaefd8bebb5acd2477c554cc9f77a7353f2f2d0395cbdbd025b3fdf3c31b8c  ./imgpkg-darwin-arm64
d143a5719ac645ec4921bc14a184505454955a815f2e6a215de8e5aa5179c2c9  ./imgpkg-darwin-amd64
de2ea4c292833736f9627c26ab43191f923aa96ae0c66dc95c546be42e0f90c5  ./imgpkg-linux-amd64

v0.39.0

✨ What's new

• 🚨 For library users 🚨 the go module name changes to carvel.dev/imgpkg this is a breaking change on this version, no impact for users that only use the binaries

Full Changelog: v0.38.1...v0.39.0

📂 Files Checksum

2bfbe2a5b69ab4da652753af9b335ad5dd222780428f064aedd2f50bd11e2693  ./imgpkg-darwin-amd64
378ba1c3b06361d9695c92b54e803309e1bc28084de492c58ed0c993f3987b82  ./imgpkg-darwin-arm64
7b247c24850dbf4ff70095b6d7f5aff12aea15d0ece9e9ecf66f92e3c9d2f332  ./imgpkg-linux-arm64
98b80baa5d665c5119fc8e2a62978f9d193c9647e3c47ab72867b055b94d14ff  ./imgpkg-linux-amd64
b2e38dc24985451633b76151c8d9ef300944fe73ca18ca28d0ae74a756f2f2eb  ./imgpkg-windows-amd64.exe

v0.38.5

What's Changed

• Fixing CVE by @rohitagg2020 in #694

Full Changelog: v0.38.4...v0.38.5

📂 Files Checksum

27b4ecf8b8984e295ee5b5a7dd79301a5801925c84dc8e6232aa8eba774e71fc  ./imgpkg-windows-amd64.exe
28a5ac5187e8b3dcf99c12fc8554c6114fd42a35fb68365e9522b06fb0a55f18  ./imgpkg-linux-arm64
7a370dc23ee2bfacdf026fd75a4950ea909d7d1257621fc00fdebd00921f5a68  ./imgpkg-darwin-arm64
aaaebfa5e13cf794423a2f9b5067a8cbb01561c8c2bf3d9d4cb230c21cbab0fd  ./imgpkg-linux-amd64
b6110699dcbfaa25ffd0b2bd1e7f776f5d8b650f1b8827b44d20e5b7dff065dd  ./imgpkg-darwin-amd64

v0.38.3

What's Changed

• Bump go version to 1.21.5 by @rcmadhankumar in #618

Full Changelog: v0.38.2...v0.38.3
📂 Files Checksum

39385a86ad320f30d7b4487675983aabe56c36be8069ba9d6fdcf7cb544da718  ./imgpkg-linux-amd64
68d9cde3d16036acca6d1c02c2883a3005175ed21716339e7945dd47b8cc71e1  ./imgpkg-windows-amd64.exe
6f4432ef68df53356fa68c3ba5a24522987ffb9ab9ec157124761d0f2ffeb367  ./imgpkg-darwin-arm64
9538fa76d45afb92d407a4e75c33250835628e2a0e6172dfc86c13937d94ad14  ./imgpkg-linux-arm64
d51cdb0f65510ed53c84810c6f1fa29982302a340d4d7dce1a17fb3c1ffecc6e  ./imgpkg-darwin-amd64

v0.38.2

What's Changed

• e56a33d Bump go version to 1.21.3

Full Changelog: v0.38.1...v0.38.2

📂 Files Checksum

06519df70fc05d6b289c14e8af0269d813473713c48cf1883052a52e338e147b  ./imgpkg-darwin-amd64
2037b61056c4f50e6f50c51fc473e85f2b9acc34d72a0b042a62044a1c2884a6  ./imgpkg-linux-amd64
439fb6af0b9b77ec30d7ea6f347b1a80da2356aa59a9c4718dc3e38b2843f8b1  ./imgpkg-darwin-arm64
99b422b906595fb2a3e5ad16ef1fb023094c7b340f92dfe816beec04f2b206e1  ./imgpkg-windows-amd64.exe
c6c057a003a8435fa5b5548f6a55cc4e926283cbbfa55a55f9438d61c99bc172  ./imgpkg-linux-arm64

v0.38.1

✨ What's new

• Fix issue with copy of bundles using has tags the origin repository location #582 by @rcmadhankumar

Full Changelog: v0.38.0...v0.38.1

📂 Files Checksum

136edef97a4ffe98c9a2e70549a053f409ec35cc59751e7a4b314e9db6d53074  ./imgpkg-linux-amd64
4115072c441d0cea881e96b3e0108246970eea398ca6df2329f363274f2318af  ./imgpkg-darwin-amd64
f1dfe98dbc33400ae8d525f032d745a5eb2eb19ab9e3d4580e06cfffdb3db293  ./imgpkg-darwin-arm64
fa80bfd37df86e44bc73a27046ae4305a3b680ccee0740977705bff08a07a14b  ./imgpkg-windows-amd64.exe
fb384e5f23428694cc55f0294a762d9d1c341239e838d0f0756309c78923bf55  ./imgpkg-linux-arm64

v0.37.5

✨ What's new

• Fix issue #373 by @ashpect in #561
• updated test to use complete image ref by @kumaritanushree in #564
• add ci badge to readme.md by @microwavables in #562
• Error when --image-is-bundle-check flag is set to false while using -b flag by @ashpect in #563
• Updated test to build binary locally based on variable value by @kumaritanushree in #569
• chore: remove refs to deprecated io/ioutil by @testwill in #577

🔈 Callouts

@ashpect made their first contribution in #561
@testwill made their first contribution in #577

Full Changelog: v0.37.3...v0.37.5
📂 Files Checksum

07ef96b0f34fdf4d984ceb3acaa8f34dd0d7c5e4fcbd7404f3ee4e2f424df1d3  ./imgpkg-darwin-amd64
1d16a9795f12adfaf88ac653ee4bc8123d1f0ac441099efabeeecd4e3541ccc0  ./imgpkg-darwin-arm64
264b058d9f747fbd4942d39e0a47748f907e4eea8ec7c69a20637c8ef9c7bfe0  ./imgpkg-linux-amd64
5a4be581d5375ed2387606df33f1d30f658587fcc151f3e5846a4b802710c55e  ./imgpkg-windows-amd64.exe
6cfdfa2127cfae54787c457dee52041be5210253fb887f4d01f92e6eaa50138a  ./imgpkg-linux-arm64

v0.38.0

✨ What's new

• Bumping go version to 1.21.1 by @sethiyash in #579

📂 Files Checksum

348d7172359eb51bd837990ab43a62665f25bb5e3ea2f7c36ca7cfb1da8994b8  ./imgpkg-darwin-amd64
3f272fc7eacb129a989b8f686ea59455ab7e65423192803c15d6affb963f86a9  ./imgpkg-linux-amd64
9678b49af36d48d11dcbfd262f4deb1ea7f6266dcd135c120fffa24c7002e288  ./imgpkg-darwin-arm64
975f013ac48007314a34aa2d575c09fb186db0918f446a5ef0905ec2730453ef  ./imgpkg-linux-arm64
ed641678c778844c42a5b0bfc0d66b43b92fd4c4bd7e2cd9e440e1cf2129d18e  ./imgpkg-windows-amd64.exe

v0.37.4

🔴 Please disregard this version because it bumps go to 1.21, which might cause problems if you are importing imgpkg has a library.

---

✨ What's new

• Fix issue #373 by @ashpect in #561
• updated test to use complete image ref by @kumaritanushree in #564
• add cii badge to readme.md by @microwavables in #562
• Error when --image-is-bundle-check flag is set to false while using -b flag by @ashpect in #563
• Updated test to build binary locally based on variable value by @kumaritanushree in #569
• chore: remove refs to deprecated io/ioutil by @testwill in #577
• Bumping go version to 1.21.1 by @sethiyash in #579

🔈 Callouts

• @ashpect made their first contribution in #561
• @testwill made their first contribution in #577

Full Changelog: v0.37.3...v0.37.4

📂 Files Checksum

29aaa23f5eca994520b057a73efc4483997a82977c0fc28968fd3dc27e138aa5  ./imgpkg-darwin-arm64
37b67a4f4e93a5435e56232602b7b2abdbd2aa4093b4cb1043e1462ed60c2f8a  ./imgpkg-linux-amd64
514548fa5ac866254e91fa341c79e7323d01beb88967e8900535ea1de606cc97  ./imgpkg-darwin-amd64
88a2b43d102286f6909a86db01114a0e6ec990c1bf75f4a964871761079460b7  ./imgpkg-windows-amd64.exe
9c95a4cda54a762941727f38279a7ee7d57f0372bbd7d333ac2791d6ad8a7fa2  ./imgpkg-linux-arm64

v0.37.11

What's Changed

• Bump go version to 1.22.3 in v0.37.x line by @rohitagg2020 in #665

Full Changelog: v0.37.10...v0.37.11

📂 Files Checksum

03ef81e40e4278ca1c0c55025634412206b6cc47cf06520964e683e246a185aa  ./imgpkg-windows-amd64.exe
1bf04a26b3fbd792f8c69d84ae15fb9b3b8a8d860cabdedea819d4e29317a694  ./imgpkg-linux-arm64
2f4ec66e353d19550838dcc17fac941eef0a9f14cb32eaa4a11e96ba45217724  ./imgpkg-linux-amd64
b243b0595279bf71243a99ba63ce20594327e9192d88f96450ce4863559cd463  ./imgpkg-darwin-amd64
d93107b325aeb74bf1c1f694f609fbc645bb9ddc59b6ed4776d965e53a6e9f22  ./imgpkg-darwin-arm64