checksum

Each registry's package configuration has the configuration about checksum.

e.g. GitHub CLI

packages:
  - type: github_release
    repo_owner: cli
    repo_name: cli
    # ...
    checksum:
      type: github_release
      asset: gh_{{trimV .Version}}_checksums.txt
      file_format: regexp
      algorithm: sha256
      pattern:
        checksum: ^(\b[A-Fa-f0-9]{64}\b)
        file: "^\\b[A-Fa-f0-9]{64}\\b\\s+(\\S+)$"

e.g. ArgoCD CLI

packages:
  - type: github_release
    repo_owner: argoproj
    repo_name: argo-cd
    # ...
    asset: argocd-{{.OS}}-{{.Arch}}
    checksum:
      type: github_release
      asset: "{{.Asset}}.sha256"
      file_format: raw
      algorithm: sha256

enabled

You can enable or disable the checksum download by enabled attribute.

packages:
  - type: github_release
    repo_owner: argoproj
    repo_name: argo-cd
    # ...
    checksum:
      enabled: false

By default, checkdum download is disabled.

checksum algorithm

The following algorithm are supported.

• sha1 (aqua >= v1.29.0)
• sha256
• sha512
• md5

checksum type

The following type are supported.

• github_release
• http

github_release requires the following attributes.

• asset: GitHub Release Asset name. The format is a Go's text/template string

http requires the following attributes.

• url: Checksum file's download URL. The format is a Go's text/template string

checksum file_format

The following file_format are supported.

• regexp
• raw

regexp requires the following attributes.

• pattern.checksum:
• pattern.file:

pattern:
  checksum: ^(\b[A-Fa-f0-9]{64}\b)
  file: "^\\b[A-Fa-f0-9]{64}\\b\\s+(\\S+)$"

aqua extracts pairs of checkfum and asset name using regular expressions. If the checksum file includes only one checksum, you can omit pattern.file.