jayvdb
commented
2 weeks ago https://aquaproj.github.io/docs/reference/security/checksum describes the verification the tool does. It isnt comprehensive by default. IMO we should be clear to our users if we are installing an unverifiable binary, so this needs to be part of the design for inclusion of aqua.
A lot of their tool definitions contain
checksum:
enabled: falseOr they omit the "checksum" key entirely, like https://github.com/aquaproj/aqua-registry/blob/main/pkgs/CycloneDX/cyclonedx-cli/registry.yaml and https://github.com/aquaproj/aqua-registry/blob/07ade5a0cd34c199a0f6eb0ff88295f8a23cd8ee/pkgs/ziglang/zig/registry.yaml
Here is one with a valid checksum definition https://github.com/aquaproj/aqua-registry/blob/main/pkgs/Boeing/config-file-validator/registry.yaml
I believe they have no fallback to a central storage of previously computed checksums. They provide examples of how users can update their own aqua-checksums.json in CI, for the tools they depend on.
install-action could store checksums in the install-action repo ; i.e. the file aqua-checksums.json file that aqua creates just needs to be stored in the repo, so that the aqua installer can use it. If done for a large subset of the aqua repository, unfortunately that will chew up a lot of CI. If we only wanted to do it for a small subset, then we could just as easily create normal manifests for that small subset, and there is no need for aqua.
The approach that I think makes the most sense is to allow installs of tools that do have a checksum definition in aqua. This might be done by putting the following in the aqua config that install-action creates before handing control over to aqua.
require_checksum: trueWhen I tried to install CycloneDX/cyclonedx-cli with the above set, it failed with an exit code.
> aqua install
INFO[0000] create a symbolic link aqua_version=2.29.0 command=cyclonedx env=linux/amd64 program=aqua
INFO[0000] download and unarchive the package aqua_version=2.29.0 env=linux/amd64 package_name=CycloneDX/cyclonedx-cli package_version=v0.25.1 program=aqua registry=standard
ERRO[0022] install the package aqua_version=2.29.0 doc="https://aquaproj.github.io/docs/reference/codes/001" env=linux/amd64 error="checksum is required" package_name=CycloneDX/cyclonedx-cli package_version=v0.25.1 program=aqua registry=standard
FATA[0022] aqua failed aqua_version=2.29.0 env=linux/amd64 error="it failed to install some packages" program=aqua
> echo $?However that would mean that zig cant be installed using aqua due to lack of checksum, and that was one of the reasons that I was interested in aqua.
> aqua install
INFO[0000] create a symbolic link aqua_version=2.29.0 command=zig env=linux/amd64 program=aqua
INFO[0000] download and unarchive the package aqua_version=2.29.0 env=linux/amd64 package_name=ziglang/zig package_version=0.13.0 program=aqua registry=standard
ERRO[0014] install the package aqua_version=2.29.0 doc="https://aquaproj.github.io/docs/reference/codes/001" env=linux/amd64 error="checksum is required" package_name=ziglang/zig package_version=0.13.0 program=aqua registry=standard
FATA[0014] aqua failed aqua_version=2.29.0 env=linux/amd64 error="it failed to install some packages" program=aquaHowever zig does provide checksums at https://ziglang.org/download/ , so for me the first step is to see if the aqua can support those checksums.
https://aquaproj.github.io/ looks like a decent binary installer, which might be a useful fallback strategy, especially for go tools
Its github action installer is reasonable, but not as mature as install-action, and if aqua is hacked, aqua-installer likely can also be hacked.
https://github.com/aquaproj/aqua-installer/blob/main/action.yaml
https://github.com/aquaproj/aqua-registry/tree/main/pkgs is where its package list exist.
Currently