Add git.glasklar.is/sigsum/core/sigsum-go

[nikolay]

https://git.glasklar.is/sigsum/core/sigsum-go

Library and command-line utilities in Go

https://git.glasklar.is/sigsum/core/sigsum-go/-/blob/main/doc/tools.md

• sigsum-key
• sigsum-submit
• sigsum-verify
• sigsum-token

[suzuki-shunsuke]

Thank you.
Do we need to build these tools ourselves by go install command?

https://git.glasklar.is/sigsum/core/sigsum-go/-/tree/main/cmd?ref_type=heads

go install sigsum.org/sigsum-go/cmd/sigsum-key@latest

I can't find pre-built binaries.

https://git.glasklar.is/sigsum/core/sigsum-go/-/releases

[nikolay]

Unfortunately, they don't seem to have binaries, which is strange. I saw this added to Homebrew yesterday and thought it might be an interesting add to Aqua: https://github.com/Homebrew/homebrew-core/blob/master/Formula/s/sigsum-go.rb

[suzuki-shunsuke]

I see. Thank you.
Seems like Homebrew builds these tools by go build command.

https://github.com/Homebrew/homebrew-core/blob/822635690e0742776505bd1d4acd724fd2454f42/Formula/s/sigsum-go.rb#L28

I'm considering the package name convention to update go modules by Renovate.

• feat: add _go/sigsum.org/sigsum-go/cmd/sigsum-* #28944
• Define package name convention for go datasource aqua#3267

[suzuki-shunsuke]

https://github.com/aquaproj/aqua-registry/releases/tag/v4.255.0 🎉

[suzuki-shunsuke]

To update these packages by Renovate, please update aqua-renovate-config to 2.4.0 or later.
https://github.com/aquaproj/aqua-renovate-config/releases/tag/2.4.0

[suzuki-shunsuke]

FYI

Now aqua can get available versions from Go Module Proxy.
aqua >= v2.38.0 and aqua-registry v4.256.0 are required.

https://github.com/aquaproj/aqua/releases/tag/v2.38.0
https://github.com/aquaproj/aqua-registry/releases/tag/v4.256.0

e.g.

aqua g -s _go/sigsum.org/sigsum-go#cmd/sigsum-key

aqua g -s golang.org/x/tools/gopls