aquaproj/aqua (aquaproj/aqua)
### [`v2.35.0`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.35.0)
[Compare Source](https://redirect.github.com/aquaproj/aqua/compare/v2.34.0...v2.35.0)
[Pull Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.35.0) | [Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.35.0) | https://github.com/aquaproj/aqua/compare/v2.34.0...v2.35.0
##### Features
[#3119](https://redirect.github.com/aquaproj/aqua/issues/3119) [#3131](https://redirect.github.com/aquaproj/aqua/issues/3131) Verify packages' GitHub Artifact Attestations
When aqua installs packages, it verifies their GitHub Artifact Attestations if they are provided and registries have settings for GitHub Artifact Attestations.
[#3117](https://redirect.github.com/aquaproj/aqua/issues/3117) Create GitHub Artifact Attestations of aqua
We start providing aqua's GitHub Artifact Attestations!
https://github.com/aquaproj/aqua/attestations
If you download aqua from GitHub Releases, you can verify GitHub Artifact Attestations using GitHub CLI.
https://aquaproj.github.io/docs/install#verify-downloaded-binaries-from-github-releases
Reference:
- https://aquaproj.github.io/docs/reference/security/github-artifact-attestations
- https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds
##### Fixes
[#3129](https://redirect.github.com/aquaproj/aqua/issues/3129) Redirect stdout of some commands to stderr
aqua executes some os commands to install packages.
- go install
- go build
- cargo
- cosign
- slsa-verifier
- minisign
- gh attestation verify
aqua should redirect the stdout of these commands to stderr.
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
[ ] If you want to rebase/retry this PR, check this box
This PR contains the following updates:
v2.34.0->v2.35.0Release Notes
aquaproj/aqua (aquaproj/aqua)
### [`v2.35.0`](https://redirect.github.com/aquaproj/aqua/releases/tag/v2.35.0) [Compare Source](https://redirect.github.com/aquaproj/aqua/compare/v2.34.0...v2.35.0) [Pull Requests](https://redirect.github.com/aquaproj/aqua/pulls?q=is%3Apr+milestone%3Av2.35.0) | [Issues](https://redirect.github.com/aquaproj/aqua/issues?q=is%3Aissue+milestone%3Av2.35.0) | https://github.com/aquaproj/aqua/compare/v2.34.0...v2.35.0 ##### Features [#3119](https://redirect.github.com/aquaproj/aqua/issues/3119) [#3131](https://redirect.github.com/aquaproj/aqua/issues/3131) Verify packages' GitHub Artifact Attestations When aqua installs packages, it verifies their GitHub Artifact Attestations if they are provided and registries have settings for GitHub Artifact Attestations. [#3117](https://redirect.github.com/aquaproj/aqua/issues/3117) Create GitHub Artifact Attestations of aqua We start providing aqua's GitHub Artifact Attestations! https://github.com/aquaproj/aqua/attestations If you download aqua from GitHub Releases, you can verify GitHub Artifact Attestations using GitHub CLI. https://aquaproj.github.io/docs/install#verify-downloaded-binaries-from-github-releases Reference: - https://aquaproj.github.io/docs/reference/security/github-artifact-attestations - https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds ##### Fixes [#3129](https://redirect.github.com/aquaproj/aqua/issues/3129) Redirect stdout of some commands to stderr aqua executes some os commands to install packages. - go install - go build - cargo - cosign - slsa-verifier - minisign - gh attestation verify aqua should redirect the stdout of these commands to stderr.Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.