v2.36.0

Pull Requests | Issues | v2.35.0...v2.36.0

Features

#3130 #3134 support changing $0 by symlink

Some tools change their behavior by $0.

For example, granted changes the behavior based on args[0].

https://github.com/common-fate/granted/blob/e8de3ec7d62d543062d8be802b27abb3d8fac429/cmd/granted/main.go#L37-L44

	// Use a single binary to keep keychain ACLs simple, swapping behavior via argv[0]
	var app *cli.App
	switch filepath.Base(os.Args[0]) {
	case "assumego", "assumego.exe", "dassumego", "dassumego.exe":
		app = assume.GetCliApp()
	default:
		app = granted.GetCliApp()
	}

This release supports changing $0 by symlink.

        files:
          - name: granted
          - name: assumego
            src: granted
            link: assumego # link is the relative path from src to the symlink

Bug Fixes

#3136 #3137 remove: Handle panic error when package is not found @Shion1305
#3138 remove: Ignore not found commands

v2.36.0-1

Pull Requests | Issues | v2.35.0...v2.36.0-1

Changelog

• f09f3af refactor: fix lint errors
• 30c6930 refactor: fix lint errors
• 39523e2 fix: fix the relative path
• 9b7f2f1 feat: support changing $0 by symlink
• a4f3b5a chore(deps): update dependency aquaproj/aqua to v2.35.0 (#3133)

v2.35.0

Pull Requests | Issues | v2.34.0...v2.35.0

Features

#3119 #3131 Verify packages' GitHub Artifact Attestations

When aqua installs packages, it verifies their GitHub Artifact Attestations if they are provided and registries have settings for GitHub Artifact Attestations.

#3117 Create GitHub Artifact Attestations of aqua

We start providing aqua's GitHub Artifact Attestations!

https://github.com/aquaproj/aqua/attestations

If you download aqua from GitHub Releases, you can verify GitHub Artifact Attestations using GitHub CLI.

https://aquaproj.github.io/docs/install#verify-downloaded-binaries-from-github-releases

Reference:

• https://aquaproj.github.io/docs/reference/security/github-artifact-attestations
• https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds

Fixes

#3129 Redirect stdout of some commands to stderr

aqua executes some os commands to install packages.

• go install
• go build
• cargo
• cosign
• slsa-verifier
• minisign
• gh attestation verify

aqua should redirect the stdout of these commands to stderr.

v2.35.0-1

v2.34.0...v2.35.0-1

v2.34.0

Pull Requests | Issues | v2.33.0...v2.34.0

Features

#3103 Enabling you to verify checksum files using Minisign

You can now verify checksum files using Minisign.

e.g.

        checksum:
          type: github_release
          asset: sha256.txt
          algorithm: sha256
          minisign:
            type: github_release
            asset: sha256.txt.minisig
            public_key: RWQ/i9xseZwBVE7pEniCNjlNOeeyp4BQgdZDLQcAohxEAH5Uj5DEKjv6

v2.34.0-5

v2.34.0-4...v2.34.0-5

v2.34.0-4

v2.34.0-3...v2.34.0-4

v2.34.0-3

v2.34.0-2...v2.34.0-3

v2.34.0-2

v2.34.0-1...v2.34.0-2

v2.34.0-1

v2.33.0...v2.34.0-1

Features

#3103 Verify checksum files using minisign