chore(deps): update dependency carvel-dev/imgpkg to v0.47.0

[renovate]

This PR contains the following updates:

Package	Update	Change
carvel-dev/imgpkg	minor	0.46.1 -> 0.47.0

---

Release Notes

carvel-dev/imgpkg (carvel-dev/imgpkg)

v0.47.0

Compare Source

Installation and signature verification

Installation

By downloading binary from the release

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/carvel-dev/imgpkg/releases/download/v0.47.0/imgpkg-linux-amd64

# Move the binary in to your PATH
mv imgpkg-linux-amd64 /usr/local/bin/imgpkg

# Make the binary executable
chmod +x /usr/local/bin/imgpkg

Via Homebrew (macOS or Linux)

$ brew tap carvel-dev/carvel
$ brew install imgpkg
$ imgpkg version

Verify checksums file signature

Install cosign on your system https://docs.sigstore.dev/system_config/installation/

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:

# Download the checksums file, certificate and signature
curl -LO https://github.com/carvel-dev/imgpkg/releases/download/v0.47.0/checksums.txt
curl -LO https://github.com/carvel-dev/imgpkg/releases/download/v0.47.0/checksums.txt.pem
curl -LO https://github.com/carvel-dev/imgpkg/releases/download/v0.47.0/checksums.txt.sig

# Verify the checksums file
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp=https://github.com/carvel-dev \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com

Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature.

# Verify the binary using the checksums file
sha256sum -c checksums.txt --ignore-missing

What's Changed

• Allow shallow-copy of a bundle by @​rosenhouse in #​758
• Add layer and image size information to describe command by @​mdzhigarov in #​760
• Bump golang.org/x/sys from 0.32.0 to 0.33.0 by @​dependabot in #​740
• Bump golang.org/x/sync from 0.13.0 to 0.14.0 by @​dependabot in #​741
• Bump golang to 1.24.9 by @​devanshuVmware in #​759

New Contributors

• @​rosenhouse made their first contribution in #​758

Full Changelog: carvel-dev/imgpkg@v0.46.0...v0.47.0

📂 Files Checksum

14d0083027eeba54a4804c561fb41d0c723f908ec91e073e88f3a64c52b54544  ./imgpkg-linux-arm64
465b4843ae762c6a693fffe250a13bef37536cf6fd218d791165a919214447c5  ./imgpkg-darwin-arm64
5e03036ecc48c3385618f6020bad13554493019dbb472062f6ccab28e4b01162  ./imgpkg-darwin-amd64
754abc5ed6d3dcab5791107ed355e10ba30041ba8ede1f5d94b9a733c71eae48  ./imgpkg-windows-amd64.exe
7602b6af24a818265dcb2cc0dc7f6117a3591f26e2c266f294800f99ae433da1  ./imgpkg-linux-amd64

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.