v0.46.3

Installation and signature verification

Installation

By downloading binary from the release

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.46.3/vendir-linux-amd64

# Move the binary in to your PATH
mv vendir-linux-amd64 /usr/local/bin/vendir

# Make the binary executable
chmod +x /usr/local/bin/vendir

Via Homebrew (macOS or Linux)

$ brew tap carvel-dev/carvel
$ brew install vendir
$ vendir version  

Verify checksums file signature

Install cosign on your system https://docs.sigstore.dev/system_config/installation/

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:

# Download the checksums file, certificate and signature
curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.46.3/checksums.txt
curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.46.3/checksums.txt.pem
curl -LO https://github.com/carvel-dev/vendir/releases/download/v0.46.3/checksums.txt.sig

# Verify the checksums file
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp=https://github.com/carvel-dev \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com

Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature.

# Verify the binary using the checksums file
sha256sum -c checksums.txt --ignore-missing

What's Changed

• Migrate from golang.org/x/crypto/openpgp to github.com/ProtonMail/go-crypto by @G-Gobi in #456
• chore(deps): bump github.com/cloudflare/circl from 1.6.2 to 1.6.3 by @dependabot[bot] in #466
• Hash the cache id to build the cache folder name by @akashchamp in #471
• Redact secrets in logs, normalize hostname case, and fix error message wording by @sameerforge in #474

New Contributors

• @G-Gobi made their first contribution in #456
• @akashchamp made their first contribution in #471

Full Changelog: v0.46.2...v0.46.3

📂 Files Checksum

39b1025eb03142790d5b8d262edd1c9dd5987ae97a81d0c5c4affb13850caccb  ./vendir-darwin-amd64
68aa4fb1ff9ce66510dc9a77477d3ba0e304eb0770b478cd59eb8d1a0d8cfa5a  ./vendir-windows-amd64.exe
5af8823ecc67b3ce2359bb0b70e72a5dbd765135722ca0ff42c16bc4d7409847  ./vendir-linux-amd64
52b3c224329c11f7189847fc9687a7e9f319626f893dd9a8bcc3704dbc89cc25  ./vendir-darwin-arm64
821a9da837a017270743597a2e9b796d2d256385ad85450d6c5d89f05dd5aac9  ./vendir-linux-arm64