Bug Fixes
#5577 GitHub Artifact Attestations: Pass GitHub access tokens from the keyring or ghtkn to GitHub CLI
aqua verifies GitHub Artifact Attestations by running GitHub CLI (gh attestation verify).
Before, aqua didn't pass GitHub access tokens managed by the keyring or ghtkn to GitHub CLI, so GitHub CLI called GitHub API without authentication unless GH_TOKEN, GITHUB_TOKEN, AQUA_GITHUB_TOKEN, or gh auth login was used.
So you couldn't verify packages of private repositories with the keyring or ghtkn, and the verification of public packages could fail because of the rate limit.
aqua now tries GitHub access tokens in order until the verification succeeds.
If GitHub CLI has its own credential (GH_TOKEN, GITHUB_TOKEN, or gh auth login):
- GitHub CLI's own credential
AQUA_GITHUB_TOKEN- The access token managed by the keyring
- The access token managed by ghtkn
Otherwise:
AQUA_GITHUB_TOKEN- The access token managed by the keyring
- The access token managed by ghtkn
- No access token
The same access token isn't tried twice even if it comes from different sources.
Access tokens which are invalid or hit the rate limit aren't used for the rest of the process.
If the verification fails, the error has the link to the error code 008, which describes the causes and solutions.
Behavior changes
The verification isn't skipped on authentication errors anymore
Before, aqua skipped the verification if the output of GitHub CLI contained gh auth login or set the GH_TOKEN environment variable.
Now the verification fails, because skipping the verification installs packages without verifying them.
In practice, this rarely affects you.
aqua runs GitHub CLI with GH_HOST=github.com (#4038), so GitHub CLI skips its authentication check and can verify attestations without an access token.
Rate limit errors weren't skipped before either.
If the verification fails because of the rate limit, please pass a GitHub access token by GITHUB_TOKEN, AQUA_GITHUB_TOKEN, the keyring, or ghtkn.
On GitHub Actions, you can pass ${{ github.token }}.
- run: aqua i
env:
GITHUB_TOKEN: ${{ github.token }}If you can't verify packages, you can disable the verification explicitly, though we don't recommend it.
export AQUA_DISABLE_GITHUB_ARTIFACT_ATTESTATION=truePrecedence of AQUA_GITHUB_TOKEN
If GitHub CLI has its own credential, it now takes precedence over AQUA_GITHUB_TOKEN.
Before, AQUA_GITHUB_TOKEN overrode the credential stored by gh auth login.
If GitHub CLI's own credential fails, AQUA_GITHUB_TOKEN is tried next, so the result is the same in most cases.
The exception is HTTP 404 for a private package without private: true.
aqua treats such a package as public and fails immediately without trying other access tokens.
Please set private: true to private packages.
Retries
Before, aqua retried any failure of GitHub CLI up to 5 times.
Now aqua retries only temporary failures such as HTTP 5xx and network errors, and fails immediately on failures it doesn't recognize.