v0.46.1

Installation and signature verification

Installation

By downloading binary from the release

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.46.1/vendir-linux-amd64

# Move the binary in to your PATH
mv vendir-linux-amd64 /usr/local/bin/vendir

# Make the binary executable
chmod +x /usr/local/bin/vendir

Via Homebrew (macOS or Linux)

$ brew tap carvel-dev/carvel
$ brew install vendir
$ vendir version  

Verify checksums file signature

Install cosign on your system https://docs.sigstore.dev/system_config/installation/

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:

# Download the checksums file, certificate and signature
curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.46.1/checksums.txt
curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.46.1/checksums.txt.pem
curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.46.1/checksums.txt.sig

# Verify the checksums file
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp=https://github.com/carvel-dev \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com

Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature.

# Verify the binary using the checksums file
sha256sum -c checksums.txt --ignore-missing

What's Changed

• chore(deps): bump golang.org/x/net from 0.52.0 to 0.55.0 by @dependabot[bot] in #454
• Suppress "Succeeded" line after vendir completion output by @pujitha24 in #457
• Fix OpenPGP key-fingerprint panic under GODEBUG=fips140=only by @sameerforge in #458
• Reject non-FIPS-approved git signatures under GODEBUG=fips140=only, with opt-in verification.allowLegacySignatures by @sameerforge in #458

Highlights:

Native FIPS 140-3 builds of vendir no longer panic when verifying git commit/tag signatures under GODEBUG=fips140=only. By default, a signature using a non-FIPS-approved algorithm (SHA-1, MD5, DSA) now fails with a clear error instead of crashing. Consumers who need to keep syncing repositories with legacy-signed history can opt in via a new config field:

git:
  verification:
    publicKeysSecretRef:
      name: my-trusted-keys
    allowLegacySignatures: true

When set, a non-approved algorithm is downgraded to a logged warning instead of failure.

New Contributors

• @pujitha24 made their first contribution in #457

Full Changelog: v0.46.0...v0.46.1

📂 Files Checksum

133871a31862e2ea14c55e7162d5227b3b9b54774376faf2aea3f8802dd5bf2b  ./vendir-darwin-amd64
6b87a8bab7303881ebe86119fe310e27ec23d8b2afda878b3fbcd5800d737e0d  ./vendir-windows-amd64.exe
96318c8f2f6ed8b0853b5fac50e22e400af6d8fb2699835e5a8b1663db65c6a9  ./vendir-linux-amd64
b0ed7ffa337b4964e5a0b865b786e97b75e7777fb4a289f06193671b81e320a9  ./vendir-darwin-arm64
6f9b8d829fdead89b40feca901c5804826db94121abecdc6808052c3252e847b  ./vendir-linux-arm64