v2.45.0

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.44.1...v2.45.0

Features

Improved generate-registry:

#​3560 Generate slsa_provenance
#​3562 #​3568 #​3576 Support config file and filter versions and assets
#​3566 Fix complete_windows_ext
#​3577 Sort and group version_overrides
#​3578 Merge groups with only a single release
#​3579 Move no_asset to the top

Fixes

#​3593 Support signer_workflow too
#​3603 Skip the verification of GitHub Artifact Attestation if the authentication fails

Others

#​3586 Update checksums of cosign, slsa-verifier, minisign, and GitHub CLI automatically
#​3595 Output grammar fixes @​scop
#​3580 ghattestation: Error message fixes @​scop

v2.44.1

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.44.0...v2.44.1

🐛 Bug Fixes

#​3554 update: Fix a bug that aqua up fails if import_dir is used

This is a bug of aqua v2.44.0.

v2.44.0

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.43.3...v2.44.0

Features

#​3537 init: add a command line option -d
#​3528 Support import_dir and add command line options -u and -i to aqua init command

aqua init -d # Create a directory `aqua` and create `aqua/aqua.yaml`
aqua init -u # Create aqua.yaml with `import_dir: imports`
aqua init -i pkgs # Create aqua.yaml with `import_dir: pkgs`

e.g. aqua.yaml

registries:
- type: standard
  ref: v4.311.0
import_dir: imports

You can use import_dir and packages at the same time.
In addition to packages, aqua searches packages from the directory specified with import_dir.

import_dir: imports is equivalent to the following settings.

packages:
- import: imports/*.yml
- import: imports/*.yaml

And if import_dir is set, aqua g -i command creates a directory <import_dir> and adds packages to the file <import_dir>/<command name>.yaml.
For instance, if import_dir is imports, aqua g -i cli/cli creates a directory imports and adds cli/cli to imports/gh.yaml.

If the package has multiple commands, <command name> is the first command name in the files setting.
For instance, in case of FiloSottile/age, <command name> is age.

https://github.com/aquaproj/aqua-registry/blob/d39d4b5d0fb0635f6be7a70f3cb8b994f075a639/pkgs/FiloSottile/age/registry.yaml#L13-L17

    files:
      - name: age
        src: age/age
      - name: age-keygen
        src: age/age-keygen

Fixes

#​3537 init: Fix file existence check

aqua init skips creating a configuration file if configuration files already exist.
This release improves the logic.

v2.43.3

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.43.2...v2.43.3

Features

#​3521 generate-registry: Detect checksum files from some more typical SHA filenames @​scop

Others

#​3523 Update slsa-verifier to v2.7.0
#​3514 #​3534 Update Cosign to v2.4.2

v2.43.2

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.43.1...v2.43.2

Bug Fixes

#​3506 Exclude unavailable versions from the list of aqua g -s and aqua up -s

v2.43.1

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.43.0...v2.43.1

v2.43.0

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.42.2...v2.43.0

Features

#​3467 #​3478 Support vacuuming unused packages

https://aquaproj.github.io/docs/guides/vacuum

Now you can remove unused packages by aqua vacuum command, which is useful to save storage and keep your machine clean.

aqua vacuum

This command removes installed packages which haven't been used for over the expiration days.
The default expiration days is 60, but you can change it by the environment variable $AQUA_VACUUM_DAYS or the command line option aqua vacuum -days <expiration days>.

e.g.

export AQUA_VACUUM_DAYS=90

aqua vacuum -d 30

[!CAUTION]
aqua vacuum command doesn't remove links from the bin directory and doesn't remove packages from aqua.yaml

As of aqua v2.43.0, aqua records packages' last used date times.
Date times are updated when packages are installed or executed.
Packages installed by aqua v2.42.2 or older don't have records of last used date times, so aqua can't remove them.
To solve the problem, aqua vacuum --init is available.

aqua vacuum --init

aqua vacuum --init searches installed packages from aqua.yaml including $AQUA_GLOBAL_CONFIG and records the current date time as the last used date time of those packages if their last used date times aren't recorded.

aqua vacuum --init can't record date times of install packages which are not found in aqua.yaml.
If you want to record their date times, you need to remove them by aqua rm command and re-install them.

v2.42.2

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.42.1...v2.42.2

🐛 Bug Fixes

#​3436 Fix a bug that aqua update command fails if version_expr or go_version_file is used

As of this release, aqua update command ignores packages with version_expr or go_version_file.

v2.42.1

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.42.0...v2.42.1

🐞 Bug Fixes

#​3433 Create symlinks if unarchived files are symlinks

This fixes a bug of aqua v2.42.0. #​3432

v2.42.0

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.41.0...v2.42.0

[!CAUTION]
This version has a known buhttps://github.com/aquaproj/aqua/issues/3432/3432
This bug was fixed at v2.42.1. https://github.com/aquaproj/aqua/releases/tag/v2.42.1

Features

#​3422 Support 7 zip

Others

#​3422 Replace mholt/archiver/v3 with mholt/archives

mholt/archiver/v3 was deprecated and it's encourage to migrate to mholt/archives.

v2.41.0

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.40.0...v2.41.0

Features

#​3407 Support cargo install's --locked option

https://aquaproj.github.io/docs/reference/registry-config/cargo-package

e.g. registry.yaml:

            type: cargo
            crate: rhit
            cargo:
              locked: true

      --locked               Assert that `Cargo.lock` will remain unchanged

#​3399 update: Support filtering updated packages using package tags

https://aquaproj.github.io/docs/guides/package-tag

e.g.

aqua up -t bootstrap # Update only packages with a tag `bootstrap`
aqua up --exclude-tags bootstrap # Exclude packages with a tag `bootstrap`

v2.40.0

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.39.1...v2.40.0

Features

#​3363 Support getting package versions from external files

This release enables you to get package versions from external files.
This feature is useful when:

• Migrate any tool to aqua gradually
• Support aqua and other tools

This release adds some fields to aqua.yaml's packages.

• version_expr: An expr expression to read external files
• version_expr_prefix: A prefix of version

e.g.

packages:
- name: hashicorp/terraform
  version_expr: |
    "v" + readFile('.terraform-version')

  version_expr: |
    readJSON('version.json').version
  version_expr_prefix: cli-

  version_expr: |
    readYAML('version.yaml').version

version_expr is evaluated using expr.
The following custom functions are available.

• readFile("file path"): reads a file and returns a file content
• readJSON("file path"): read and unmarshal a JSON file and returns an object
• readYAML("file path"): read and unmarshal a YAML file and returns an object

⚠️ Constraint of version_expr

Allowing to read external files is potentially risky in terms of security.
Malicious users can try to read secret files and expose secrets via log using version_expr.
To prevent such a threat, we restrict the evaluation result of version_expr.
It must match with the regular expression ^v?\d+\.\d+(\.\d+)*[.-]?((alpha|beta|dev|rc)[.-]?)?\d*.

v2.39.1

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.39.0...v2.39.1

Fixes

#​3365 cargo: Normalize the install path of cargo packages

Others

#​3361 Refactor reading config

v2.39.0

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.38.4...v2.39.0

Features

#​3354 policy: add a code comment for YAML Language Servers to a generated file aqua-policy.yaml

##### yaml-language-server: $schema=https://raw.githubusercontent.com/aquaproj/aqua/main/json-schema/policy.json

#​3352 init: Add a code comment for YAML Language Servers to a generated file aqua.yaml

##### yaml-language-server: $schema=https://raw.githubusercontent.com/aquaproj/aqua/main/json-schema/aqua-yaml.json

These code comments are useful when you edit files with editors such as VSCode.

v2.38.4

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.38.3...v2.38.4

Bug Fixes

#​3337 generate-registry: Fix a bug that unused replacements are added

v2.38.3

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.38.2...v2.38.3

Bug Fixes

#​3325 #​3333 Fix a bug that aqua g -i removes comments from packages

v2.38.2

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.38.1...v2.38.2

🐛 Bug Fixes

#​3307 generate-registry: Fix a bug that description isn't formatted

v2.38.1

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.38.0...v2.38.1

Fixes

#​3297 completion: Improve the completion settings suggested in aqua completion --help @​akinomyoga

v2.38.0

Compare Source

Pull Requests | Issues | aquaproj/aqua@v2.37.2...v2.38.0

Features

#​3269 Get available versions from Go Module Proxy

https://aquaproj.github.io/docs/reference/registry-config/go-version-path

This release adds the new field go_version_path to registries.

e.g.

packages:
  - name: _go/sigsum.org/sigsum-go#cmd/sigsum-key
    type: go_install
    path: sigsum.org/sigsum-go/cmd/sigsum-key
    go_version_path: sigsum.org/sigsum-go

If this field is set, aqua g and aqua up commands gets available versions from Go Module Proxy.