Verify checksums transparently by storing checksums in registries

[suzuki-shunsuke]

Feature Overview

Store checksums in registries and verify checksums.

Why is the feature needed?

As you know, aqua has the feature for checksum verification.

https://aquaproj.github.io/docs/reference/security/checksum/

This is very awesome, but this feature is disabled by default.
I think it's difficult to enable this feature by default because to enable this feature in Git projects users need to manage aqua-checksums.json with Git, which means users need to update aqua-checksums.json continuously.
We provide GitHub Actions and CircleCI Orb to automate the update of aqua-checksums.json,
but I don't think most of users set up them.
Unfortunately, I don't think most of users are so interested in the checksum verification.

⚠️ This is just my expectation, so maybe this is wrong.

So I don't think most people verify checksums, this is undesirable and dangerous.

By the way, Homebrew verifies checksums transparently by keeping checksums in formula.
It's so nice.

So I'm thinking that we store checksums in registries and aqua verifies checksums with them.
Users don't need to set up anything but aqua verifies checksums transparently.

This improves the security without harming the user experience.

Workaround

No response

Example Code

No response

Note

No response

[jayvdb]

https://github.com/taiki-e/install-action also stores checksums in the repo.

In taiki-e/install-action#526 I proposed using aqua as a fallback, but the lack of a central store of pre-computed checksums looks like it will make this more difficult.

Also in that issue I note that the ziglang/zig tool here doesnt have a checksum definition, when https://ziglang.org/download/ does have checksum files available. Are they in a supported format?

[suzuki-shunsuke]

Thank you for your comment. I didn't know that action.
As you said, the action stores checksums in the repository and updates them automatically when new versions are released.
This is exactly same as what this issue proposed.

• Update manifest taiki-e/install-action#564
• https://github.com/taiki-e/install-action/blob/048abf9a2afde655a94eafc83ae02548a812afa5/manifests/biome.json#L47-L72

https://ziglang.org/download/ does have checksum files available.

I can't find checksum files. Could you tell me some URLs?

[jayvdb]

example sig
https://ziglang.org/builds/zig-0.14.0-dev.130+cb308ba3a.tar.xz.minisig

[suzuki-shunsuke]

Oh, I see. I'm not familiar with minisig minisign, but aqua doesn't support it for now.

[suzuki-shunsuke]

About minisin, I created an issue.

• Support verifying packages with minisign #2978