Bug Fixes
#1742 #1752 install: install command succeeded unexpectedly even if unknown packages are included
This bug was caused by 40154d3 v1.19.5 (2022-10-01).
Others
#1718 #1721 #1755 #1756 Use slsa-verifier as CLI instead of Go library to separate slsa-verifier from aqua itself
#1753 update google/go-github from v45 to v50
Use slsa-verifier as CLI instead of Go library to separate slsa-verifier from aqua itself
From aqua v1.26.0, aqua has supported verifing packages by slsa-verifier. aqua used slsa-verifier as a Go library, but then some issues occured because slsa-verifier is so large.
- aqua binary becomes so large 5 MB => 15 MB
- It takes a long time to build aqua
- #1717 Renovate fails to run
go mod tidyandgo get
Especially, #1717 was critical.
To solve these issues, we decided to use slsa-verifer as CLI instead of Go library.