chore(deps): update dependency aquaproj/aqua to v2.64.0

[renovate]

This PR contains the following updates:

Package	Update	Change
aquaproj/aqua	minor	v2.62.3 → v2.64.0

---

Release Notes

aquaproj/aqua (aquaproj/aqua)

v2.64.0

Compare Source

Features

#​5364 Support installing only specified packages by command or package names

aqua install now accepts command names or package names as positional arguments. Only packages matching them are installed.

aqua i gh                                 # by command name
aqua i cli/cli                            # by package name
aqua i gh suzuki-shunsuke/tfcmt           # multiple names

If any of the given names isn't found in the configuration files, the command fails:

ERR aqua failed not_found="[bar foo]" error="packages or commands aren't found in configuration files"

#​5279 Add a settings file

${XDG_CONFIG_HOME:-$HOME/.config}/aquaproj-aqua/config.yaml

checksum:
  enabled: true
  require: true
  enforce: true
  enforce_require: true
lazy_install: true
policy:
  enabled: true
  config: /home/foo/policy.yaml
tracking: true
progress_bar: false
log:
  level: info
  color: auto
max_parallelism: 5
global_config: /home/foo/aqua-global.yaml
root_dir: /home/foo/.local/share/aquaproj-aqua
keyring: false

config.yaml	environment variable
checksum.enabled	AQUA_CHECKSUM
checksum.require	AQUA_REQUIRE_CHECKSUM
checksum.enforce	AQUA_ENFORCE_CHECKSUM
checksum.enforce_require	AQUA_ENFORCE_REQUIRE_CHECKSUM
lazy_install	AQUA_DISABLE_LAZY_INSTALL (inverted)
policy.enabled	AQUA_DISABLE_POLICY (inverted)
policy.config	AQUA_POLICY_CONFIG
tracking	AQUA_DISABLE_TRACKING (inverted)
progress_bar	AQUA_PROGRESS_BAR
log.level	AQUA_LOG_LEVEL
log.color	AQUA_LOG_COLOR
max_parallelism	AQUA_MAX_PARALLELISM
global_config	AQUA_GLOBAL_CONFIG
root_dir	AQUA_ROOT_DIR
keyring	AQUA_KEYRING_ENABLED

Precedence: Environment variable > settings file > default

Performance Improvement

#​5283 Detect glibc by its loader instead of by running ldd

Bug Fixes

#​5284 gr: Don't take a build for particular hardware as the ordinary one
#​5285 gr: shorter isn't the point, the same name with less on it is
#​5287 Say what cosign said, and wait long enough for it to matter
#​5310 gr: Don't claim a provenance that is another artifact's

v2.63.0

Compare Source

Security

Fix a path traversal vulnerability GHSA-286g-rf2x-cv99.
When a package archive contained a GNU sparse file, aqua re-extracted the whole archive with the host tar, applying none of its own path or symlink containment. On hosts whose tar follows symlinks during extraction (e.g. BusyBox tar), a crafted archive could plant a symlink escaping the install directory and write a regular file through it. aqua now keeps the system tar out of the install directory: it validates the sparse member names, extracts them into a staging directory, and moves each to its verified destination itself.

Features

#​5117 Create timestamp files as group writable and document read only $AQUA_ROOT_DIR
#​5115 Support AQUA_DISABLE_TRACKING to disable the tracking of last used date times

Fixes

#​5237 Skip minisign verification if the host platform doesn't support minisign
#​5188 Ignore incomplete release assets in aqua gr
#​5178 Support files[].src in go_install packages
#​5171 Extract 7z archives that use the ARM64 filter
#​5161 signer_workflow is a literal path, not a regex

Others

#​5239 Fix Dockerfile build failure caused by a stale apt package index

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.