Features
#4924 #5574 #5575 minisign: Support linux/arm64
aqua now verifies packages with minisign on linux/arm64 too. Before, minisign verification was skipped on linux/arm64.
Bug Fixes
#5549 #5551 Windows: Don't chmod regular files every time a command runs
On Windows, aqua called os.Chmod on the executable every time a command ran through the shim, because Go's os.Stat never reports a regular file as executable on Windows.
So aqua failed with install the package: check file_src is correct when it couldn't change file attributes, e.g. in Codex CLI's read-only sandbox, even though the package was already installed.
aqua now treats any regular file as executable on Windows, so os.Chmod is no longer called.
When os.Chmod fails, the error now includes the underlying OS error.
#5529 update-aqua: Stop requiring SLSA Provenance of aqua v2.65.0 or later
aqua update-aqua no longer requires SLSA Provenance (multiple.intoto.jsonl) for aqua v2.65.0 or later.
The checksum file is still verified with Cosign (aqua_{{trimV .Version}}_checksums.txt.sigstore.json).
aqua older than v2.65.0 is still verified with SLSA Provenance.
aqua keeps publishing SLSA Provenance for now, and will stop once old aqua requiring it is no longer used.
Others
#5523 Publish packslip.sigstore.json so that aqua can be verified with packslip
#5506 Update Cosign used to verify packages to v3.1.4
#5512 Update GoReleaser to v2.19.0
#5553 ci: Update go-release-workflow
#5545 docs(aqua-installer): Document packages input
#5546 Remove tools