chore(deps): update dependency aquaproj/aqua to v1.38.0

[renovate]

This PR contains the following updates:

Package	Update	Change
aquaproj/aqua	minor	v1.30.1 -> v1.38.0

---

Release Notes

aquaproj/aqua (aquaproj/aqua)

v1.38.0

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.37.2...v1.38.0

Features

#​1781 #​1783 Support configuring require_checksum by the environment variable

export AQUA_REQUIRE_CHECKSUM=true # false

If require_checksum is configured in a configuration file, the environment variable is ignored.
If checksum isn't enabled in a configuration file, the environment variable is ignored.

Why is the feature needed?

To combine security and convenience.
In CI we would like to enable require_checksum for security.
On the other hand, we don't want to enable require_checksum in your laptops for convenience.
If require_checksum is enabled, you have to run aqua update-checksum when you change the package version.
Otherwise, it fails to run the package. This is a bad experience.

v1.37.2

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.37.1...v1.37.2

Fixes

#​1777 init, init-policy: remove broken links

aqua.yaml and aqua-policy.yaml generated by aqua init and aqua init-policy commands contained broken links.
So we removed them.

v1.37.1

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.37.0...v1.37.1

Bug Fixes

#​1771 #​1772 Fixed a bug that update-checksum --deep command fails if go_install package is used

v1.37.0

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.36.1...v1.37.0

Features

#​1762 Support default checksum parser

aqua supported two checksum file format raw and regexp and the file format is mandatory.
This pull request supports a default file format and the file format becomes optional.

If a checksum file contains only one line and doesn't contain a space , a file content is treated as checksum.

e.g.

0549CBAA2DF451CF3A2011A9D73A9CB127784D26749D9CD14C9F4818AF104D44

Each line is split by a space .
The first element is treated as a checksum
The second element is treated as a file path, and the base name is treated as the asset name.

e.g.

944fdfebfdf1026d318609cc706bad454196f0b1d76e557b56c829b0e6165a9f  ./kapp-linux-arm64
9aaa735985efbe240af0ca1d80adf3b43be6cf4ec6620a053082e31bea25dae7  ./kapp-linux-amd64
dcbf6dd9b4cecfc6316391029a6e9a5f3863e6a1f7848eb5fb78bfdbdc06faf8  ./kapp-darwin-amd64
e802044c2676455464675e290ea5b5eed7da9741eae1260af8d8d15355495db3  ./kapp-windows-amd64.exe
f059d708fc550c516d1f04ee4c82efd8bc346c480156c03a3445825c73d827a6  ./kapp-darwin-arm64

Why this feature is needed

This feature works well flexibly and we don't have to fix checksum configuration when the checksum file format is changed.
We don't have to write complicated regular expressions.
This feature improves the maintainability of checksum configuration.

Others

#​1764 Update Go from v1.20.1 to v1.20.2

v1.36.1

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.36.0...v1.36.1

Bug Fixes

#​1742 #​1752 install: install command succeeded unexpectedly even if unknown packages are included

This bug was caused by aquaproj/aqua@40154d3 v1.19.5 (2022-10-01).

#​1746 #​1757 Clear unrelated fields if package type is changed by overrides or version_overrides

Others

#​1718 #​1721 #​1755 #​1756 Use slsa-verifier as CLI instead of Go library to separate slsa-verifier from aqua itself
#​1753 update google/go-github from v45 to v50

Use slsa-verifier as CLI instead of Go library to separate slsa-verifier from aqua itself

#​1718 #​1721

From aqua v1.26.0, aqua has supported verifing packages by slsa-verifier. aqua used slsa-verifier as a Go library, but then some issues occured because slsa-verifier is so large.

• aqua binary becomes so large 5 MB => 15 MB
• It takes a long time to build aqua
• #​1717 Renovate fails to run go mod tidy and go get

Especially, #​1717 was critical.

To solve these issues, we decided to use slsa-verifer as CLI instead of Go library.

v1.36.0

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.35.0...v1.36.0

Features

#​1668 #​1710 Show files in a package if an executable file isn't found
#​1704 #​1705 Output HTTP status code when it fails to install a http package

Show files in a package if an executable file isn't found

#​1668 #​1710

e.g.

$ aqua i --test
ERRO[0000] check file_src is correct                     aqua_version= env=darwin/arm64 error="check file_src is correct: exe_path isn't found: stat /Users/shunsukesuzuki/.local/share/aquaproj-aqua/pkgs/github_release/github.com/Azure/aks-engine/v0.76.0/aks-engine-v0.76.0-darwin-amd64.tar.gz/aks-engine: no such file or directory" file_name=aks-engine package_name=Azure/aks-engine package_version=v0.76.0 program=aqua registry=standard
ERRO[0000] executable files aren't found
Files in the unarchived package:
aks-engine-v0.76.0-darwin-amd64/aks-engine
   aqua_version= env=darwin/arm64 package_name=Azure/aks-engine package_version=v0.76.0 program=aqua registry=standard
ERRO[0000] install the package                           aqua_version= env=darwin/arm64 error="check file_src is correct" package_name=Azure/aks-engine package_version=v0.76.0 program=aqua registry=standard
FATA[0000] aqua failed                                   aqua_version= env=darwin/arm64 error="it failed to install some packages" program=aqua

v1.35.0

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.34.2...v1.35.0

Features

#​1692 #​1699 Output the content of a checksum file when it fails to parse a checksum file
#​1684 #​1687 Support outputting error messages when a package is installed
#​1693 #​1695 Add a field no_asset to package configuration for returing an error because there is no asset

Output the content of a checksum file when it fails to parse a checksum file

#​1692 #​1699

This is useful to fix the package's checksum configuration.

e.g.

ERRO[0005] Checksum isn't found in a checksum file. Checksum file content:
237db2e5a4fa7525362c012e94c8a76b36a73d138ac7950cc1c07d862a7cc74a  github-comment_5.0.3_windows_amd64.tar.gz
48e49e0b5f1b3af4b5be13b7031bfb38d856259f09f3582e4f67bcae4b357429  github-comment_5.0.3_linux_arm64.tar.gz
58a32e01623ea00fc3650ffb149f724d3e76a06b2aa5237bb128da138ee79359  github-comment_5.0.3_linux_amd64.tar.gz
621a03cd09ee7eb57d9a00cdfb8c2fe70232b64db070c74122df5a0d7f26ae02  github-comment_5.0.3_darwin_arm64.tar.gz
b893acb1bef079724017590a115bc1447208ea92b0c1fdf8563c6dfc1ef19ff0  github-comment_5.0.3_darwin_amd64.tar.gz
c1a3e184957850e333e24ee437a14b55c8ea78d2e190be71c0f72b0eac0e09d7  github-comment_5.0.3_windows_arm64.tar.gz  aqua_version= checksum_file_format=regexp checksum_pattern_checksum="^(\\b[A-Fa-f0-9]{128}\\b)" checksum_pattern_file="^\\b[A-Fa-f0-9]{128}\\b\\s+(\\S+)$" env=darwin/arm64 exe_name=github-comment exe_path=/Users/shunsukesuzuki/.local/share/aquaproj-aqua/pkgs/github_release/github.com/suzuki-shunsuke/github-comment/v5.0.3/github-comment_5.0.3_darwin_arm64.tar.gz/github-comment package=suzuki-shunsuke/github-comment package_name=suzuki-shunsuke/github-comment package_version=v5.0.3 program=aqua registry=standard

Support outputting error messages when a package is installed

#​1684 #​1687

e.g.

registry.yaml

packages:
  - type: github_release
    repo_owner: grafana
    repo_name: xk6
    version_constraint: semver("< 0.9.0")
    version_overrides:
      - version_constraint: semver(">= 0.9.0")
        error_message: |
          From version xk6 v0.9.0 there are no more binaries published.

          https://github.com/grafana/xk6/issues/60

$ xk6 --help                   
ERRO[0000] failed to install a package grafana/xk6@​v0.9.0. From version xk6 v0.9.0 there are no more binaries published.

https://github.com/grafana/xk6/issues/60  aqua_version= env=darwin/arm64 exe_name=xk6 exe_path=/Users/shunsukesuzuki/.local/share/aquaproj-aqua/pkgs/github_release/github.com/grafana/xk6/v0.9.0/xk6_0.9.0_mac_arm64.tar.gz/xk6 package=grafana/xk6 package_name=grafana/xk6 package_version=v0.9.0 program=aqua registry=standard
FATA[0000] aqua failed                                   aqua_version= env=darwin/arm64 error= exe_name=xk6 package=grafana/xk6 package_version=v0.9.0 program=aqua

Add a field no_asset to package configuration for returing an error because there is no asset

#​1693 #​1695

e.g.

registry.yaml

packages:
  - type: github_release
    repo_owner: grafana
    repo_name: xk6
    version_constraint: semver("< 0.9.0")
    version_overrides:
      - version_constraint: semver(">= 0.9.0")
      	no_asset: true

$ xk6 --help                   
ERRO[0000] failed to install a package grafana/xk6@​v0.9.0. No asset is released in this version  aqua_version= env=darwin/arm64 exe_name=xk6 exe_path=/Users/shunsukesuzuki/.local/share/aquaproj-aqua/pkgs/github_release/github.com/grafana/xk6/v0.9.0/xk6_0.9.0_mac_arm64.tar.gz/xk6 package=grafana/xk6 package_name=grafana/xk6 package_version=v0.9.0 program=aqua registry=standard
FATA[0000] aqua failed                                   aqua_version= env=darwin/arm64 error= exe_name=xk6 package=grafana/xk6 package_version=v0.9.0 program=aqua

Fixes

#​1700 #​1701 Remove exe_path from log

exe_path isn't helpful in many cases. exe_path is long, so this is a bit noisy.

v1.34.2

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.34.1...v1.34.2

Bug Fixes

#​1682 #​1685 generate-registry: Fix --deep option to handle GitHub Releases not conforming to semantic versioning

v1.34.1

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.34.0...v1.34.1

Bug Fixes

#​1092 #​1675 #​1677 #​1678 generate-registry: Refactoring and fix some bugs

v1.34.0

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.33.0...v1.34.0

Features

#​1655 #​1662 generate-registry: Support generating version_overrides and testdata

https://aquaproj.github.io/docs/reference/scaffold-registry/#generate-version_overrides-by---deep-option

Add command line options --deep and --out-testdata to aqua gr command.

• --deep: Generate version_overrides
• --out-testdata: Output testdata to a file

⚠️ --deep option calls GitHub API per GitHub Release. So if there are a lot of GitHub Releases, many GitHub API are called and GitHub API rate limiting may occur.

Fixes

#​1639 generate-registry: Support md5 and sha1
#​1640 generate-registry: Fix checksum asset names
#​1611 Use the default configuration if the package version doesn't match any version_constraint

Others

#​1638 generate-registry: Refactoring

v1.33.0

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.32.3...v1.33.0

Features

#​1595 #​1615 #​1626 Support keeping configuration files in one directory

https://aquaproj.github.io/docs/tutorial-extras/keep-in-one-dir

aqua has several configuration files such as aqua.yaml, aqua-checksums.json, policy file, and imported files.

e.g.

aqua.yaml
aqua-checksums.json
aqua-policy.yaml # You can rename freely
aqua/ # You can rename freely
  terraform.yaml
  ...

From aqua v1.33.0, aqua supports keeping configuration files in one directory.

e.g.

aqua/ # or .aqua
  aqua.yaml
  aqua-checksums.json
  policy.yaml # You can rename freely
  imports/ # You can rename freely
    terraform.yaml
    ...

This is useful to keep the working directory clean.

How to migrate

• Update aqua to v1.33.0 or later
• Update update-checksum-action to v0.2.0 or later
• Update update-checksum-workflow to v0.1.1 or later
• Move files
  • aqua.yaml => aqua/aqua.yaml
  • aqua-checksums.json => aqua/aqua-checksums.json
  • aqua-policy.yaml => aqua/policy.yaml # rename freely
  • imported files => aqua/imports/*.yaml # change the filename freely
• Fix AQUA_POLICY_CONFIG
• Fix GitHub Actions Path filters
• Fix aqua-renovate-config's file preset argument

v1.32.3

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.32.2...v1.32.3

Bug Fixes

#​1610 fix a bug Registry's checksums are compared without normalization

This bug occurs when a Registry is installed and the Registry's checksum in aqua-checksums.json is uppercase,
because the calculated checksum is lowercase.

This bug raised by https://github.com/aquaproj/aqua/releases/tag/v1.32.2 , because the release made checksums uppercase.

e.g.

time="2023-02-02T01:22:11Z" level=error msg="install the registry" actual_checksum=603942e90f42411891411460a1ff5ceac0e9ae9233cc828b7cab5d8bedd76d90bbe5476e6744c50de6827869da2641562990fe649dd5f872cb98397b2e2c30e6 aqua_version=1.32.2 env=linux/amd64 error="check a registry's checksum: checksum is invalid" expected_checksum=603942E90F42411891411460A1FF5CEAC0E9AE9233CC828B7CAB5D8BEDD76D90BBE5476E6744C50DE6827869DA2641562990FE649DD5F872CB98397B2E2C30E6 program=aqua registry_name=standard

v1.32.2

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.32.1...v1.32.2

Bug Fixes

#​1599 #​1600 Skip setting checksum if the key already exists

Fixes

#​1601 Normalize checksum when a newly added

v1.32.1

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.32.0...v1.32.1

Fixes

#​1585 #​1588 Retry slsa-verifier when slsa-verifier failed due to timeout

v1.32.0

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.31.0...v1.32.0

Features

generate-registry: Support specifying version

e.g.

$ aqua gr suzuki-shunsuke/[email protected]

v1.31.0

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.30.4...v1.31.0

Features

#​1545 #​1552 Add the attribute version_prefix to Registry Configuration

• Add the attribute version_prefix to Registry Configuration
• Add the parameter SemVer to expr expressions and template variables
• versions are filtered by this attribute same as version_filter
  • We would be able to replace version_filter to version_prefix in many cases
• Instead of Version, the parameter Semver is used in the function semver

You can filter versions with a specific prefix and trim the prefix from versions by version_prefix.

For example, kubernetes-sigs/kustomize has a prefix kustomize/.

- type: github_release
    repo_owner: kubernetes-sigs
    repo_name: kustomize
    version_prefix: kustomize/
    asset: kustomize_{{.SemVer}}_{{.OS}}_{{.Arch}}.tar.gz
    version_constraint: semver(">= 4.5.4")
    version_overrides:
      - version_constraint: semver(">= 4.4.1")
        supported_envs:
          - linux
          - darwin
          - amd64
      - version_constraint: semver(">= 4.2.0")
        supported_envs:
          - linux
          - darwin
      - version_constraint: semver("< 4.2.0")
        rosetta2: true
        supported_envs:
          - linux
          - darwin
          - amd64

Bug Fixes

Fixed bugs regarding to Cosign.

#​1554 #​1557 Retry the verification by Cosign
#​1555 #​1558 Get a lock before executing Cosign to prevent Cosign from being executing in parallel
#​1559 Get a Lock before installing Cosign
#​1559 Fix a bug that options of Cosign could be wrong if the same package's multiple versions are installed at the same time

v1.30.4

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.30.3...v1.30.4

Bug Fixes

#​1541 generate: remove a newline

From aqua v1.25.2, a newline was inserted unnecessarily.

e.g.

$ aqua g -i suzuki-shunsuke/tfcmt

registries:
- type: standard
  ref: v3.118.0
packages:
- name: suzuki-shunsuke/[email protected]

By this release, the newline is removed.

registries:
- type: standard
  ref: v3.118.0
packages:
- name: suzuki-shunsuke/[email protected]

#​1548 #​1549 Return error if version doesn't match with all version_constraints

v1.30.3

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.30.2...v1.30.3

Features

#​1539 Verify checksums of aqua-proxy to prevent aqua-proxy from being tampered. Checksums are hardcoded to aqua.

Others

#​1540 Update aqua-proxy from v1.1.2 to v1.1.4

v1.30.2

Compare Source

Pull Requests | Issues | aquaproj/aqua@v1.30.2-1...v1.30.2

Bug Fixes

#​1528 #​1530 Fix a bug that Cosign isn't installed properly if AQUA_GOOS and AQUA_GOARCH are set

Others

#​1391 #​1526 Sign checksum files by Cosign

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.