v0.16.1
✨ What's new
- Bumped crypto 0.17.0 by @kumaritanushree in #515
- Signing artifacts and updated release notes to have steps to be followed for installation and verification by @kumaritanushree in #518
- Bumping go version to v1.21.6 by @sethiyash in #517
Installation and signature verification
Verify checksums file signature
Install cosign on your system https://docs.sigstore.dev/system_config/installation/
The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:
# Download the checksums file, certificate, and signature
curl -LO https://github.com/carvel-dev/secretgen-controller/releases/download/v0.16.1/checksums.txt
curl -LO https://github.com/carvel-dev/secretgen-controller/releases/download/v0.16.1/checksums.txt.pem
curl -LO https://github.com/carvel-dev/secretgen-controller/releases/download/v0.16.1/checksums.txt.sig
### Verify the checksums file
cosign verify-blob checksums.txt --certificate checksums.txt.pem --signature checksums.txt.sig --certificate-identity-regexp=https://github.com/carvel-dev --certificate-oidc-issuer=https://token.actions.githubusercontent.com
Installation of secretgen-controller
secretgen-controller can be installed by using kapp
kapp deploy -a sg -f https://github.com/carvel-dev/secretgen-controller/releases/v0.16.1/download/release.yml
or by using kubectl
kubectl deploy -f https://github.com/carvel-dev/secretgen-controller/releases/v0.16.1/download/release.yml
Container Images
secretgen-controller and secretgen-controller-package-bundle images are available in Github Container Registry.
OCI Image URLs
- ghcr.io/carvel-dev/secretgen-controller@sha256:8131cb502e4080bdf12e43e72439ed738992b2bb19423d1030cdcc1b8aa38e28
- ghcr.io/carvel-dev/secretgen-controller-package-bundle@sha256:15767f33ef0b730a866b7219760909a9adeecf0a3e5d4e5aa5aab34471f52a0f
Verify container image signature
The container images are signed using Cosign with GitHub OIDC. To validate the signature of OCI images, run the following commands:
# Verifying secretgen-controller image
cosign verify ghcr.io/carvel-dev/secretgen-controller@sha256:8131cb502e4080bdf12e43e72439ed738992b2bb19423d1030cdcc1b8aa38e28 --certificate-identity-regexp=https://github.com/carvel-dev --certificate-oidc-issuer=https://token.actions.githubusercontent.com -o text
# Verifying secretgen-controller-package-bundle image
cosign verify ghcr.io/carvel-dev/secretgen-controller-package-bundle@sha256:15767f33ef0b730a866b7219760909a9adeecf0a3e5d4e5aa5aab34471f52a0f --certificate-identity-regexp=https://github.com/carvel-dev --certificate-oidc-issuer=https://token.actions.githubusercontent.com -o text
Full Changelog: v0.16.0...v0.16.1
📂 Files Checksum
0e6beec1999ad8cebb61152b4dcce9c904d16fb75d24e373ddcdfe325690ba59 ./release.yml
8dd062978aaaf3d5bccf745c1f99ef94c01f7e972c7901e2aff06ea579c53d1d ./package.yml
8f185deaa02964663bc3cedcb7c0af46151676e7c2abc2b69ff04178f87f28fe ./package-metadata.yml