Skip to main content

checksum

Each registry's package configuration has the configuration about checksum.

e.g. GitHub CLI

packages:
  - type: github_release
    repo_owner: cli
    repo_name: cli
    # ...
    checksum:
      type: github_release
      asset: gh_{{trimV .Version}}_checksums.txt
      file_format: regexp
      algorithm: sha256
      pattern:
        checksum: ^(\b[A-Fa-f0-9]{64}\b)
        file: "^\\b[A-Fa-f0-9]{64}\\b\\s+(\\S+)$"

e.g. ArgoCD CLI

packages:
  - type: github_release
    repo_owner: argoproj
    repo_name: argo-cd
    # ...
    asset: argocd-{{.OS}}-{{.Arch}}
    checksum:
      type: github_release
      asset: "{{.Asset}}.sha256"
      file_format: raw
      algorithm: sha256

enabled​

You can enable or disable the checksum download by enabled attribute.

packages:
  - type: github_release
    repo_owner: argoproj
    repo_name: argo-cd
    # ...
    checksum:
      enabled: false

By default, checkdum download is disabled.

checksum algorithm​

The following algorithm are supported.

  • sha1 (aqua >= v1.29.0)
  • sha256
  • sha512
  • md5

checksum type​

The following type are supported.

  • github_release
  • http

github_release requires the following attributes.

  • asset: GitHub Release Asset name. The format is a Go's text/template string

http requires the following attributes.

  • url: Checksum file's download URL. The format is a Go's text/template string

checksum file_format​

The following file_format are supported.

  • regexp
  • raw

regexp requires the following attributes.

  • pattern.checksum:
  • pattern.file:
pattern:
  checksum: ^(\b[A-Fa-f0-9]{64}\b)
  file: "^\\b[A-Fa-f0-9]{64}\\b\\s+(\\S+)$"

aqua extracts pairs of checkfum and asset name using regular expressions. If the checksum file includes only one checksum, you can omit pattern.file.