feat(carvel-dev/imgpkg): cosign config

pkgs/carvel-dev/imgpkg/pkg.yaml

@@ -1,5 +1,7 @@
 packages:
   - name: carvel-dev/[email protected]
+  - name: carvel-dev/imgpkg
+    version: v0.39.0
   - name: carvel-dev/imgpkg
     version: v0.35.0
   - name: carvel-dev/imgpkg

pkgs/carvel-dev/imgpkg/registry.yaml

@@ -79,6 +79,14 @@ packages:
           - darwin
           - windows
           - amd64
+      - version_constraint: semver("< 0.40.0")
+        asset: imgpkg-{{.OS}}-{{.Arch}}
+        format: raw
+        windows_arm_emulation: true
+        checksum:
+          type: github_release
+          asset: checksums.txt
+          algorithm: sha256
       - version_constraint: "true"
         asset: imgpkg-{{.OS}}-{{.Arch}}
         format: raw
@@ -87,3 +95,13 @@ packages:
           type: github_release
           asset: checksums.txt
           algorithm: sha256
+          cosign:
+            opts:
+              - --certificate-identity
+              - https://github.com/carvel-dev/imgpkg/.github/workflows/release.yml@refs/tags/{{.Version}}
+              - --certificate-oidc-issuer
+              - https://token.actions.githubusercontent.com
+              - --signature
+              - https://github.com/carvel-dev/imgpkg/releases/download/{{.Version}}/checksums.txt.sig
+              - --certificate
+              - https://github.com/carvel-dev/imgpkg/releases/download/{{.Version}}/checksums.txt.pem