v0.58.0

Installation and signature verification

Installation of kctrl

By downloading binary from the release

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/carvel-dev/kapp-controller/releases/download/v0.58.0/kctrl-linux-amd64
# Move the binary in to your PATH
mv kctrl-linux-amd64 /usr/local/bin/kctrl
# Make the binary executable
chmod +x /usr/local/bin/kctrl

Via Homebrew (macOS or Linux)

$ brew tap carvel-dev/carvel
$ brew install kctrl
$ kctrl version

Verify checksums file signature

Install cosign on your system https://docs.sigstore.dev/system_config/installation/

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:

# Download the checksums file, certificate, and signature
curl -LO https://github.com/carvel-dev/kapp-controller/releases/download/v0.58.0/checksums.txt
curl -LO https://github.com/carvel-dev/kapp-controller/releases/download/v0.58.0/checksums.txt.pem
curl -LO https://github.com/carvel-dev/kapp-controller/releases/download/v0.58.0/checksums.txt.sig

### Verify the checksums file
cosign verify-blob checksums.txt --certificate checksums.txt.pem --signature checksums.txt.sig --certificate-identity-regexp=https://github.com/carvel-dev --certificate-oidc-issuer=https://token.actions.githubusercontent.com 

Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature. For instance, if you are using Linux on an AMD64 architecture:

# Verify the binary using the checksums file
sha256sum -c checksums.txt --ignore-missing

Installation of kapp-controller

kapp-controller can be installed by using kapp

kapp deploy -a kc -f https://github.com/carvel-dev/kapp-controller/releases/download/v0.58.0/release.yml

or by using kubectl

kubectl deploy -f https://github.com/carvel-dev/kapp-controller/releases/download/v0.58.0/release.yml

Container Images

Kapp-controller and Kapp-controller-package-bundle images are available in Github Container Registry.

OCI Image URLs

• ghcr.io/carvel-dev/kapp-controller@sha256:52ecad550cd3e98b6a27ca85e851c5b0884b04d99003ea201a289f75e33d9232
• ghcr.io/carvel-dev/kapp-controller-package-bundle@sha256:65973945afcd3f7c104f0506eade52d032f9851737c573bafd3556aed02c8bcc

Verify container image signature

The container images are signed using Cosign with GitHub OIDC. To validate the signature of OCI images, run the following commands:

# Verifying kapp-controller image
cosign verify ghcr.io/carvel-dev/kapp-controller@sha256:52ecad550cd3e98b6a27ca85e851c5b0884b04d99003ea201a289f75e33d9232 --certificate-identity-regexp=https://github.com/carvel-dev --certificate-oidc-issuer=https://token.actions.githubusercontent.com -o text

# Verifying kapp-controller-package-bundle image
cosign verify ghcr.io/carvel-dev/kapp-controller-package-bundle@sha256:65973945afcd3f7c104f0506eade52d032f9851737c573bafd3556aed02c8bcc --certificate-identity-regexp=https://github.com/carvel-dev --certificate-oidc-issuer=https://token.actions.githubusercontent.com -o text

✨ What's new

• Update go version to fix CVEs @devanshuVmware #1732
• Bump carvel dependencies #1723

Full Changelog: v0.57.0...v0.58.0

📂 Files Checksum

e49152835e085221e9f9646a6c23ee0f13040cbcdf758b3301541bdd7fabd0d9  ./release.yml
e6f2cf55d12974f7fff268e47e1f0d924f9a69b3b8f78589b6941f908b4da0fe  ./kctrl-darwin-amd64
bc75e2c25ff2a01ba86a5889746887642bfb7fab27fa58614d3ae6af57196929  ./kctrl-darwin-arm64
ede5d31ac4dfe73e82364cf430ef5016de309185606c981cbdbdbeab42589ca0  ./kctrl-linux-amd64
f253f9accf118dfeaabbaffc71d9c7bcb5f4c0e87ba4bd4bfd95edd7ab0af700  ./kctrl-linux-arm64
0842451df69c7503d423cf8ed25d66f4e072b8d22082eb48ab08d48e8c528bb7  ./kctrl-windows-amd64.exe
fe7bac5abaa4f8bdbb7067619a2cd104903a6ec53d4573a322e09c16e4ed03cf  ./package.yml
7a6aa35600459a1797a6f0564ae89954e6da035fe54e19b72c573f5b31938a8c  ./package-metadata.yml