Security
Fix a path traversal vulnerability GHSA-286g-rf2x-cv99.
When a package archive contained a GNU sparse file, aqua re-extracted the whole archive with the host tar, applying none of its own path or symlink containment. On hosts whose tar follows symlinks during extraction (e.g. BusyBox tar), a crafted archive could plant a symlink escaping the install directory and write a regular file through it. aqua now keeps the system tar out of the install directory: it validates the sparse member names, extracts them into a staging directory, and moves each to its verified destination itself.
Features
#5117 Create timestamp files as group writable and document read only $AQUA_ROOT_DIR
#5115 Support AQUA_DISABLE_TRACKING to disable the tracking of last used date times
Fixes
#5237 Skip minisign verification if the host platform doesn't support minisign
#5188 Ignore incomplete release assets in aqua gr
#5178 Support files[].src in go_install packages
#5171 Extract 7z archives that use the ARM64 filter
#5161 signer_workflow is a literal path, not a regex
Others
#5239 Fix Dockerfile build failure caused by a stale apt package index