aquaproj/aqua v2.65.0 on GitHub

v2.64.0...v2.65.0

⚠️ Security

#5485 Update Go to v1.27.3

This release is built with Go 1.27.3, which fixes CVE-2026-111943 in crypto/x509. Go now refuses trust in a small set of intermediate certificates of a specific Certificate Authority, after its CA keys were reported compromised. Verify filters out chains containing those intermediates. The Go team highly recommends upgrading immediately.

aqua relies on crypto/x509 to verify the TLS certificates of the servers it downloads registries, packages, checksums, and signatures from. We recommend upgrading.

ref.

This release also includes Go 1.27.2 (#5407), which has security fixes to the go command and the crypto/tls, html/template, net/http, net/textproto, and os packages.

https://go.dev/doc/devel/release#go1.27.2

Features

Install packages from the releases of Forgejo, Gitea, and GitLab

#5387 forgejo_release
#5391 gitea_release
#5399 gitlab_release

Until now, a package hosted on Codeberg, gitea.com, or gitlab.com had to be an http package with a URL template, often with version_constraint: "false". Nothing could list its versions, so aqua g and aqua up couldn't update it.

These package types have the same fields as github_release, plus host:

packages:
  - type: forgejo_release
    host: codeberg.org
    repo_owner: mergiraf
    repo_name: mergiraf
    asset: mergiraf_{{.Arch}}-{{.OS}}.{{.Format}}
    format: tar.gz
    replacements:
      darwin: apple-darwin
      linux: unknown-linux-gnu
      amd64: x86_64
      arm64: aarch64

aqua gr supports them too, e.g. aqua gr gitlab.com/gitlab-org/cli.

#5403 Verify packages with packslip

aqua can now verify packages with packslip, like it already does with cosign, slsa-verifier, minisign, and GitHub Artifact Attestations.
aqua downloads the signed release bundle packslip.sigstore.json from the package's release and runs packslip verify <bundle> --artifact <asset> before unarchiving the asset.

packslip:
  enabled: true # optional, default true
  url: ...             # optional, where the bundle is
  pubkey: ...          # --pubkey
  identity: ...        # --identity
  identity_prefix: ... # --identity-prefix
  issuer: ...          # --issuer
  pin: ...             # --pin
  allow_unlogged: true # --allow-unlogged

#5414 Pass more of the signing certificate to `gh attestation verify`

github_artifact_attestations gains six optional fields:

Field	Flag
`repository`	`--repo`, defaulting to the package's repository as before
`signer_repo`	`--signer-repo`
`cert_oidc_issuer`	`--cert-oidc-issuer`
`deny_self_hosted_runners`	`--deny-self-hosted-runners`
`source_ref`	`--source-ref`
`source_digest`	`--source-digest`

#5425 aqua gr: Infer a libc variant for a musl build beside the Linux one

Bug Fixes

#5362 #5367 Windows: Fix the infinite loop of a shim started with an upper-case extension such as nu.EXE

Tools that build a command name from PATHEXT, such as Python's shutil.which and just, start a shim as nu.EXE. aqua didn't find the package and ran the shim itself again until it failed. Command names are now matched case-insensitively on all OSes, preferring an exact match, and on Windows aqua skips its bin directory in PATH case-insensitively.

#5363 #5375 Windows: Fix the infinite loop of batch files such as npx and npm of nodejs/node

cmd.exe runs the first token of the command line rather than the executable path, so npx.cmd and npm.cmd started the shim again until it ran out of memory. aqua now runs a batch file (.bat / .cmd) by its absolute path.

#5406 Close the temporary file of a downloaded asset

On Windows, the leaked handle could keep the temporary file from being removed.

#5423 aqua gr: Cancel a promoted replacement for an OS that doesn't use it
#5436 aqua gr: Don't take an SBOM for the package's asset
#5444 aqua gr: Exclude 32-bit ARM assets by name

Others

#5368 Remove -ldflags
#5461 ci: Enable split_build of go-release-workflow
#5431 ci: Use go-autofix-action's reusable workflow
#5439 ci: Replace go-test-full-workflow with go-test-workflow and test-workflow

Dependency updates

#5407 #5485 Update Go to v1.27.3
#5477 Update github.com/google/go-github to v93
#5386 Update golang.org/x/sync to v0.24.0
#5396 Update golang.org/x/sys to v0.49.0