Added changes to sign artifacts #339
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: kumari tanushree <ktanushree@vmware.com>
kumaritanushree
requested review from
joaopapereira,
praveenrewar,
rohitagg2020 and
rcmadhankumar
|
@kumaritanushree Was this tested on a fork? (Just curious because I don't see the "Setup cosign" step) |
github-actions
bot
added
the
carvel-triage
Thank you @praveenrewar for pointing this. I have tested the process in fork but this step got missed in this PR. Added new PR to fix this |
renovate bot
added a commit
to mykso/myks
that referenced
this pull request
Jan 22, 2024
[](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [carvel.dev/vendir](https://togithub.com/carvel-dev/vendir) | `v0.38.0` -> `v0.39.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>carvel-dev/vendir (carvel.dev/vendir)</summary> ### [`v0.39.0`](https://togithub.com/carvel-dev/vendir/releases/tag/v0.39.0) [Compare Source](https://togithub.com/carvel-dev/vendir/compare/v0.38.0...v0.39.0) <details> <summary><h2>Installation and signature verification</h2></summary> ##### Installation ##### By downloading binary from the release For instance, if you are using Linux on an AMD64 architecture: ```shell ### Download the binary curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.39.0/vendir-linux-amd64 ### Move the binary in to your PATH mv vendir-linux-amd64 /usr/local/bin/vendir ### Make the binary executable chmod +x /usr/local/bin/vendir ``` ##### Via Homebrew (macOS or Linux) ```shell $ brew tap carvel-dev/carvel $ brew install vendir $ vendir version ``` ##### Verify checksums file signature Install cosign on your system https://docs.sigstore.dev/system_config/installation/ The checksums file provided within the artifacts attached to this release is signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of this file, run the following commands: ```shell ### Download the checksums file, certificate and signature curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.39.0/checksums.txt curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.39.0/checksums.txt.pem curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.39.0/checksums.txt.sig ### Verify the checksums file cosign verify-blob checksums.txt \ --certificate checksums.txt.pem \ --signature checksums.txt.sig \ --certificate-identity-regexp=https://github.com/carvel-dev \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com ``` ##### Verify binary integrity To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature. ```shell ### Verify the binary using the checksums file sha256sum -c checksums.txt --ignore-missing ``` </details> ### ✨ What's new * fix grammar in README by @​vtrent[carvel-dev/vendir#324 * Added changes to sign artifacts by @​kumaritanushr[carvel-dev/vendir#339 * Simplify gitignore and make sure all binaries are accounted for by @​100m[carvel-dev/vendir#351 * PrivateKey with or without extra char as newline will be accepted by @​kumaritanushr[carvel-dev/vendir#349 * Fix race condition when running multiple vendir from the same directory by @​Zebrad[carvel-dev/vendir#345 * Refactor lazy sync code by @​Zebrad[carvel-dev/vendir#340 * Fix: updated setup cosign step in release process by @​kumaritanushr[carvel-dev/vendir#352 * updated release to have installation and verification steps included in release notes by @​kumaritanushr[carvel-dev/vendir#354 #### New Contributors * @​vtrenton made their first contributi[carvel-dev/vendir#324 * @​100mik made their first contributi[carvel-dev/vendir#351 **Full Changelog**: carvel-dev/vendir@v0.38.0...v0.39.0 ### 📂 Files Checksum 012531a2f1a2de8bc89f1623edfc40a7ac5aee421fe609085278fb9e287f1cdf ./vendir-linux-arm64 20b71cc25dc3fea31edf9667c92a05167f713935f854882159736443c2f7a0e6 ./vendir-windows-amd64.exe 90ae82718c1072831f3097bdb031d5a897cc9f2f8334e2e1d7f35e35d0abd84f ./vendir-darwin-amd64 91ecf04ad5cdfa0f8839dc1430da7a4da665f7cb88c64c0c72202f6db261e651 ./vendir-darwin-arm64 feb2836153508adfb6fd33c127e466c9ce26577678e93a252be2fec445f4501f ./vendir-linux-amd64 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/mykso/myks). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xMzUuMCIsInVwZGF0ZWRJblZlciI6IjM3LjEzNS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
](https://renovatebot.com){kind=link}
renovate bot
added a commit
to mykso/myks
that referenced
this pull request
Jan 22, 2024
[](https://renovatebot.com) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [carvel-dev/vendir](https://togithub.com/carvel-dev/vendir) | minor | `v0.38.0` -> `v0.39.0` | --- ### Release Notes <details> <summary>carvel-dev/vendir (carvel-dev/vendir)</summary> ### [`v0.39.0`](https://togithub.com/carvel-dev/vendir/releases/tag/v0.39.0) [Compare Source](https://togithub.com/carvel-dev/vendir/compare/v0.38.0...v0.39.0) <details> <summary><h2>Installation and signature verification</h2></summary> ##### Installation ##### By downloading binary from the release For instance, if you are using Linux on an AMD64 architecture: ```shell ### Download the binary curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.39.0/vendir-linux-amd64 ### Move the binary in to your PATH mv vendir-linux-amd64 /usr/local/bin/vendir ### Make the binary executable chmod +x /usr/local/bin/vendir ``` ##### Via Homebrew (macOS or Linux) ```shell $ brew tap carvel-dev/carvel $ brew install vendir $ vendir version ``` ##### Verify checksums file signature Install cosign on your system https://docs.sigstore.dev/system_config/installation/ The checksums file provided within the artifacts attached to this release is signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of this file, run the following commands: ```shell ### Download the checksums file, certificate and signature curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.39.0/checksums.txt curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.39.0/checksums.txt.pem curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.39.0/checksums.txt.sig ### Verify the checksums file cosign verify-blob checksums.txt \ --certificate checksums.txt.pem \ --signature checksums.txt.sig \ --certificate-identity-regexp=https://github.com/carvel-dev \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com ``` ##### Verify binary integrity To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature. ```shell ### Verify the binary using the checksums file sha256sum -c checksums.txt --ignore-missing ``` </details> ### ✨ What's new * fix grammar in README by @​vtrent[carvel-dev/vendir#324 * Added changes to sign artifacts by @​kumaritanushr[carvel-dev/vendir#339 * Simplify gitignore and make sure all binaries are accounted for by @​100m[carvel-dev/vendir#351 * PrivateKey with or without extra char as newline will be accepted by @​kumaritanushr[carvel-dev/vendir#349 * Fix race condition when running multiple vendir from the same directory by @​Zebrad[carvel-dev/vendir#345 * Refactor lazy sync code by @​Zebrad[carvel-dev/vendir#340 * Fix: updated setup cosign step in release process by @​kumaritanushr[carvel-dev/vendir#352 * updated release to have installation and verification steps included in release notes by @​kumaritanushr[carvel-dev/vendir#354 #### New Contributors * @​vtrenton made their first contributi[carvel-dev/vendir#324 * @​100mik made their first contributi[carvel-dev/vendir#351 **Full Changelog**: carvel-dev/vendir@v0.38.0...v0.39.0 ### 📂 Files Checksum 012531a2f1a2de8bc89f1623edfc40a7ac5aee421fe609085278fb9e287f1cdf ./vendir-linux-arm64 20b71cc25dc3fea31edf9667c92a05167f713935f854882159736443c2f7a0e6 ./vendir-windows-amd64.exe 90ae82718c1072831f3097bdb031d5a897cc9f2f8334e2e1d7f35e35d0abd84f ./vendir-darwin-amd64 91ecf04ad5cdfa0f8839dc1430da7a4da665f7cb88c64c0c72202f6db261e651 ./vendir-darwin-arm64 feb2836153508adfb6fd33c127e466c9ce26577678e93a252be2fec445f4501f ./vendir-linux-amd64 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/mykso/myks). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xMzUuMCIsInVwZGF0ZWRJblZlciI6IjM3LjEzNS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.