[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aqua	uses-with	minor	v2.63.0 → v2.66.1

---

Release Notes

aquaproj/aqua (aqua)

v2.66.1

Compare Source

Bug Fixes

#​5577 GitHub Artifact Attestations: Pass GitHub access tokens from the keyring or ghtkn to GitHub CLI

aqua verifies GitHub Artifact Attestations by running GitHub CLI (gh attestation verify).
Before, aqua didn't pass GitHub access tokens managed by the keyring or ghtkn to GitHub CLI, so GitHub CLI called GitHub API without authentication unless GH_TOKEN, GITHUB_TOKEN, AQUA_GITHUB_TOKEN, or gh auth login was used.
So you couldn't verify packages of private repositories with the keyring or ghtkn, and the verification of public packages could fail because of the rate limit.

aqua now tries GitHub access tokens in order until the verification succeeds.

If GitHub CLI has its own credential (GH_TOKEN, GITHUB_TOKEN, or gh auth login):

1. GitHub CLI's own credential
2. AQUA_GITHUB_TOKEN
3. The access token managed by the keyring
4. The access token managed by ghtkn

Otherwise:

1. AQUA_GITHUB_TOKEN
2. The access token managed by the keyring
3. The access token managed by ghtkn
4. No access token

The same access token isn't tried twice even if it comes from different sources.
Access tokens which are invalid or hit the rate limit aren't used for the rest of the process.

If the verification fails, the error has the link to the error code 008, which describes the causes and solutions.

Behavior changes

The verification isn't skipped on authentication errors anymore

Before, aqua skipped the verification if the output of GitHub CLI contained gh auth login or set the GH_TOKEN environment variable.
Now the verification fails, because skipping the verification installs packages without verifying them.

In practice, this rarely affects you.
aqua runs GitHub CLI with GH_HOST=github.com (#​4038), so GitHub CLI skips its authentication check and can verify attestations without an access token.
Rate limit errors weren't skipped before either.

If the verification fails because of the rate limit, please pass a GitHub access token by GITHUB_TOKEN, AQUA_GITHUB_TOKEN, the keyring, or ghtkn.
On GitHub Actions, you can pass ${{ github.token }}.

- run: aqua i
  env:
    GITHUB_TOKEN: ${{ github.token }}

If you can't verify packages, you can disable the verification explicitly, though we don't recommend it.

export AQUA_DISABLE_GITHUB_ARTIFACT_ATTESTATION=true

Precedence of AQUA_GITHUB_TOKEN

If GitHub CLI has its own credential, it now takes precedence over AQUA_GITHUB_TOKEN.
Before, AQUA_GITHUB_TOKEN overrode the credential stored by gh auth login.
If GitHub CLI's own credential fails, AQUA_GITHUB_TOKEN is tried next, so the result is the same in most cases.

The exception is HTTP 404 for a private package without private: true.
aqua treats such a package as public and fails immediately without trying other access tokens.
Please set private: true to private packages.

Retries

Before, aqua retried any failure of GitHub CLI up to 5 times.
Now aqua retries only temporary failures such as HTTP 5xx and network errors, and fails immediately on failures it doesn't recognize.

Others

#​5578 #​5585 #​5587 ci: Update workflows

v2.66.0

Compare Source

Features

#​4924 #​5574 #​5575 minisign: Support linux/arm64

aqua now verifies packages with minisign on linux/arm64 too. Before, minisign verification was skipped on linux/arm64.

• aquaproj/aqua-registry#63807

Bug Fixes

#​5549 #​5551 Windows: Don't chmod regular files every time a command runs

On Windows, aqua called os.Chmod on the executable every time a command ran through the shim, because Go's os.Stat never reports a regular file as executable on Windows.
So aqua failed with install the package: check file_src is correct when it couldn't change file attributes, e.g. in Codex CLI's read-only sandbox, even though the package was already installed.

aqua now treats any regular file as executable on Windows, so os.Chmod is no longer called.
When os.Chmod fails, the error now includes the underlying OS error.

#​5529 update-aqua: Stop requiring SLSA Provenance of aqua v2.65.0 or later

aqua update-aqua no longer requires SLSA Provenance (multiple.intoto.jsonl) for aqua v2.65.0 or later.
The checksum file is still verified with Cosign (aqua_{{trimV .Version}}_checksums.txt.sigstore.json).
aqua older than v2.65.0 is still verified with SLSA Provenance.

aqua keeps publishing SLSA Provenance for now, and will stop once old aqua requiring it is no longer used.

Others

#​5523 Publish packslip.sigstore.json so that aqua can be verified with packslip
#​5506 Update Cosign used to verify packages to v3.1.4
#​5512 Update GoReleaser to v2.19.0
#​5553 ci: Update go-release-workflow
#​5545 docs(aqua-installer): Document packages input
#​5546 Remove tools

v2.65.2

Compare Source

Bug Fixes

#​5494 Fix the failure of installing aqua on Windows

v2.65.1

Compare Source

🐛 Bug Fixes

#​5486 Fix a bug that it fails to install packslip
#​5486 Fix a bug that aqua upa fails for v2.65.0 or later
#​5493 Publish SLSA Provenance again

Others

#​5490 Update aqua-proxy to v1.2.14

v2.65.0

Compare Source

[!WARNING]
aqua v2.17.0 - v2.65.0 can't install this version by aqua update-aqua v2.65.0, because this release doesn't have the SLSA Provenance (multiple.intoto.jsonl) which they require.
Please use v2.65.1 or later instead.
aqua-installer v4.1.0 or older also fails to install aqua_version: v2.65.0. aqua-installer v4.1.1 or later can install it.

⚠️ Security

#​5485 Update Go to v1.27.3

This release is built with Go 1.27.3, which fixes CVE-2026-111943 in crypto/x509. Go now refuses trust in a small set of intermediate certificates of a specific Certificate Authority, after its CA keys were reported compromised. Verify filters out chains containing those intermediates. The Go team highly recommends upgrading immediately.

aqua relies on crypto/x509 to verify the TLS certificates of the servers it downloads registries, packages, checksums, and signatures from. We recommend upgrading.

ref.

• https://go.dev/doc/devel/release#go1.27.3
• https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html

This release also includes Go 1.27.2 (#​5407), which has security fixes to the go command and the crypto/tls, html/template, net/http, net/textproto, and os packages.

• https://go.dev/doc/devel/release#go1.27.2

Features

Install packages from the releases of Forgejo, Gitea, and GitLab

#​5387 forgejo_release
#​5391 gitea_release
#​5399 gitlab_release

Until now, a package hosted on Codeberg, gitea.com, or gitlab.com had to be an http package with a URL template, often with version_constraint: "false". Nothing could list its versions, so aqua g and aqua up couldn't update it.

These package types have the same fields as github_release, plus host:

packages:
  - type: forgejo_release
    host: codeberg.org
    repo_owner: mergiraf
    repo_name: mergiraf
    asset: mergiraf_{{.Arch}}-{{.OS}}.{{.Format}}
    format: tar.gz
    replacements:
      darwin: apple-darwin
      linux: unknown-linux-gnu
      amd64: x86_64
      arm64: aarch64

aqua gr supports them too, e.g. aqua gr gitlab.com/gitlab-org/cli.

#​5403 Verify packages with packslip

aqua can now verify packages with packslip, like it already does with cosign, slsa-verifier, minisign, and GitHub Artifact Attestations.
aqua downloads the signed release bundle packslip.sigstore.json from the package's release and runs packslip verify <bundle> --artifact <asset> before unarchiving the asset.

packslip:
  enabled: true # optional, default true
  url: ...             # optional, where the bundle is
  pubkey: ...          # --pubkey
  identity: ...        # --identity
  identity_prefix: ... # --identity-prefix
  issuer: ...          # --issuer
  pin: ...             # --pin
  allow_unlogged: true # --allow-unlogged

#​5414 Pass more of the signing certificate to gh attestation verify

github_artifact_attestations gains six optional fields:

Field	Flag
repository	--repo, defaulting to the package's repository as before
signer_repo	--signer-repo
cert_oidc_issuer	--cert-oidc-issuer
deny_self_hosted_runners	--deny-self-hosted-runners
source_ref	--source-ref
source_digest	--source-digest

#​5425 aqua gr: Infer a libc variant for a musl build beside the Linux one

Bug Fixes

#​5362 #​5367 Windows: Fix the infinite loop of a shim started with an upper-case extension such as nu.EXE

Tools that build a command name from PATHEXT, such as Python's shutil.which and just, start a shim as nu.EXE. aqua didn't find the package and ran the shim itself again until it failed. Command names are now matched case-insensitively on all OSes, preferring an exact match, and on Windows aqua skips its bin directory in PATH case-insensitively.

#​5363 #​5375 Windows: Fix the infinite loop of batch files such as npx and npm of nodejs/node

cmd.exe runs the first token of the command line rather than the executable path, so npx.cmd and npm.cmd started the shim again until it ran out of memory. aqua now runs a batch file (.bat / .cmd) by its absolute path.

#​5406 Close the temporary file of a downloaded asset

On Windows, the leaked handle could keep the temporary file from being removed.

#​5423 aqua gr: Cancel a promoted replacement for an OS that doesn't use it
#​5436 aqua gr: Don't take an SBOM for the package's asset
#​5444 aqua gr: Exclude 32-bit ARM assets by name

Others

#​5368 Remove -ldflags
#​5461 ci: Enable split_build of go-release-workflow
#​5431 ci: Use go-autofix-action's reusable workflow
#​5439 ci: Replace go-test-full-workflow with go-test-workflow and test-workflow

Dependency updates

#​5407 #​5485 Update Go to v1.27.3
#​5477 Update github.com/google/go-github to v93
#​5386 Update golang.org/x/sync to v0.24.0
#​5396 Update golang.org/x/sys to v0.49.0

v2.64.0

Compare Source

Features

#​5364 Support installing only specified packages by command or package names

aqua install now accepts command names or package names as positional arguments. Only packages matching them are installed.

aqua i gh                                 # by command name
aqua i cli/cli                            # by package name
aqua i gh suzuki-shunsuke/tfcmt           # multiple names

If any of the given names isn't found in the configuration files, the command fails:

ERR aqua failed not_found="[bar foo]" error="packages or commands aren't found in configuration files"

#​5279 Add a settings file

${XDG_CONFIG_HOME:-$HOME/.config}/aquaproj-aqua/config.yaml

checksum:
  enabled: true
  require: true
  enforce: true
  enforce_require: true
lazy_install: true
policy:
  enabled: true
  config: /home/foo/policy.yaml
tracking: true
progress_bar: false
log:
  level: info
  color: auto
max_parallelism: 5
global_config: /home/foo/aqua-global.yaml
root_dir: /home/foo/.local/share/aquaproj-aqua
keyring: false

config.yaml	environment variable
checksum.enabled	AQUA_CHECKSUM
checksum.require	AQUA_REQUIRE_CHECKSUM
checksum.enforce	AQUA_ENFORCE_CHECKSUM
checksum.enforce_require	AQUA_ENFORCE_REQUIRE_CHECKSUM
lazy_install	AQUA_DISABLE_LAZY_INSTALL (inverted)
policy.enabled	AQUA_DISABLE_POLICY (inverted)
policy.config	AQUA_POLICY_CONFIG
tracking	AQUA_DISABLE_TRACKING (inverted)
progress_bar	AQUA_PROGRESS_BAR
log.level	AQUA_LOG_LEVEL
log.color	AQUA_LOG_COLOR
max_parallelism	AQUA_MAX_PARALLELISM
global_config	AQUA_GLOBAL_CONFIG
root_dir	AQUA_ROOT_DIR
keyring	AQUA_KEYRING_ENABLED

Precedence: Environment variable > settings file > default

Performance Improvement

#​5283 Detect glibc by its loader instead of by running ldd

Bug Fixes

#​5284 gr: Don't take a build for particular hardware as the ordinary one
#​5285 gr: shorter isn't the point, the same name with less on it is
#​5287 Say what cosign said, and wait long enough for it to matter
#​5310 gr: Don't claim a provenance that is another artifact's

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • "before 8am on Saturday,before 8am on Sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.