v0.17.0

✨ What's new

• Bumped crypto 0.17.0 by @kumaritanushree in #515
• Signing artifacts and updated release notes to have steps to be followed for installation and verification by @kumaritanushree in #518
• Bumping go version to v1.21.6 by @sethiyash in #517

Installation and signature verification

Verify checksums file signature

Install cosign on your system https://docs.sigstore.dev/system_config/installation/

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:

# Download the checksums file, certificate, and signature
curl -LO https://github.com/carvel-dev/secretgen-controller/releases/download/v0.17.0/checksums.txt
curl -LO https://github.com/carvel-dev/secretgen-controller/releases/download/v0.17.0/checksums.txt.pem
curl -LO https://github.com/carvel-dev/secretgen-controller/releases/download/v0.17.0/checksums.txt.sig

### Verify the checksums file
cosign verify-blob checksums.txt --certificate checksums.txt.pem --signature checksums.txt.sig --certificate-identity-regexp=https://github.com/carvel-dev --certificate-oidc-issuer=https://token.actions.githubusercontent.com 

Installation of secretgen-controller

secretgen-controller can be installed by using kapp

kapp deploy -a sg -f https://github.com/carvel-dev/secretgen-controller/releases/v0.17.0/download/release.yml

or by using kubectl

kubectl deploy -f https://github.com/carvel-dev/secretgen-controller/releases/v0.17.0/download/release.yml

Container Images

secretgen-controller and secretgen-controller-package-bundle images are available in Github Container Registry.

OCI Image URLs

• ghcr.io/carvel-dev/secretgen-controller@sha256:b098c97fb5a142931610d5743943df939ca84218093c8ee5e2d5b11cd8247320
• ghcr.io/carvel-dev/secretgen-controller-package-bundle@sha256:01f8fe55ec65a3d233d937fb447e54b2b93f6b02c569e3e3b6cf9ae50f2e8cf0

Verify container image signature

The container images are signed using Cosign with GitHub OIDC. To validate the signature of OCI images, run the following commands:

# Verifying secretgen-controller image
cosign verify ghcr.io/carvel-dev/secretgen-controller@sha256:b098c97fb5a142931610d5743943df939ca84218093c8ee5e2d5b11cd8247320 --certificate-identity-regexp=https://github.com/carvel-dev --certificate-oidc-issuer=https://token.actions.githubusercontent.com -o text

# Verifying secretgen-controller-package-bundle image
cosign verify ghcr.io/carvel-dev/secretgen-controller-package-bundle@sha256:01f8fe55ec65a3d233d937fb447e54b2b93f6b02c569e3e3b6cf9ae50f2e8cf0 --certificate-identity-regexp=https://github.com/carvel-dev --certificate-oidc-issuer=https://token.actions.githubusercontent.com -o text

Full Changelog: v0.16.0...v0.17.0

📂 Files Checksum

5b0507cea2ae544a6d0d2c0ee9b67b4017819a985b87a0ec0778f5a41efd31e6  ./release.yml
d34a59e65c36c8a24d2fb9f9de7a59514066b73ac5a6af42351937c0bdd940c2  ./package.yml
8f185deaa02964663bc3cedcb7c0af46151676e7c2abc2b69ff04178f87f28fe  ./package-metadata.yml