linkerd2 checksum verification fails because upstream no longer publishes separate sha256 file #42459
Description
package name
linkerd/linkerd2
aqua info
% aqua info {
"version": "2.55.0",
"commit_hash": "a2735750163c59236fda276b1a84fe301a549406",
"os": "linux",
"arch": "amd64",
"pwd": "/home/(USER)/<...>",
"root_dir": "/home/(USER)/.local/share/aquaproj-aqua",
"env": {},
"config_files": [
{
"path": "/home/(USER)/<...>/aqua.yaml"
}
]
}
% Overview
Because of GitHub's native asset checksums, linkerd2 stopped releasing .sha256 since version edge-25.9.4, which merged linkerd/linkerd2#14511. This breaks aqua's checksum verification for the 2 latest releases since the expected file is not there anymore.
I believe this also depends on aquaproj/aqua#3911 to support GitHub API checksums.
How to reproduce
aqua.yaml
---
# yaml-language-server: $schema=https://raw.githubusercontent.com/aquaproj/aqua/main/json-schema/aqua-yaml.json
# aqua - Declarative CLI Version Manager
# https://aquaproj.github.io/
# checksum:
# enabled: true
# require_checksum: true
# supported_envs:
# - all
registries:
- type: standard
ref: v4.423.0 # renovate: depName=aquaproj/aqua-registry
packages:
- name: linkerd/[email protected]Other related code such as local Registry
Executed command and output
% aqua upc
INFO[0000] updating a package checksum env=linux/amd64 package_name=linkerd/linkerd2 package_registry=standard package_version=edge-25.10.1 program=aqua program_version=2.55.0
ERRO[0000] update checksums env=linux/amd64 error=download a checksum file: the asset isn't found: linkerd2-cli-edge-25.10.1-darwin.sha256 package_name=linkerd/linkerd2 package_registry=standard package_version=edge-25.10.1 program=aqua program_version=2.55.0
/home/leonardo.dagnino/aqua-checksums.json
FATA[0000] aqua failed Expected behaviour
Native GitHub sha256 checksum should be checked
Actual behaviour
Aqua tries to download .sha256 file which does not exist for the 2 latest releases
Note
No response