Checksum verification fails for aqua-registry (Failed to download correct registries from raw.githubusercontent.com)

[t3-aoki]

package name

The package is not a specific one; it is aqua-registry itself.

aqua info

This happens in multiple versions, but here's an example:

$ aqua info
{
  "version": "2.28.0",
  "commit_hash": "ecd9e704110bf2f236b744cd6497ad50e1b52e47",
  "os": "linux",
  "arch": "amd64",
  "pwd": "/workspaces/repo",
  "root_dir": "/home/(USER)/.local/share/aquaproj-aqua",
  "env": {
    "AQUA_GLOBAL_CONFIG": "/workspaces/repo/aqua.yaml"
  },
  "config_files": [
    {
      "path": "/workspaces/repo/aqua.yaml"
    }
  ]
}

Overview

Since around 4:00 UTC on August 8, 2025, checksum verification for aqua-registry has started failing.
I use multiple versions of aqua and aqua-registry across several repositories, and the verification fails in all cases.

Examples error message:

time="2025-08-08T04:19:47Z" level=error msg="install the registry" actual_checksum=AA73FBEE71880E59A8D00E5A4AB869A8CAE8BD5BDA335B3959B12D35E8A1C9AA aqua_version=2.27.3 env=linux/amd64 error="check a registry's checksum: checksum is invalid" expected_checksum=16B8DC8967FBEC6F7E7B9205393DE8A06A49438373B71767FB73753F137D04DE program=aqua registry_name=standard
time="2025-08-08T04:19:47Z" level=fatal msg="aqua failed" aqua_version=2.27.3 env=linux/amd64 error="it failed to install some registries" program=aqua

time=2025-08-08T05:10:32Z level=error msg=install the registry actual_checksum=A74D64E68D2ED8328080DE582F8B563DE248143AB7B9EF5DDD671C5B2A626E256D650B7C787ED1D5ACB99634A63D2B0742817FF2EC9FFB430206D871212AEE7E env=linux/amd64 error=check a registry's checksum: checksum is invalid expected_checksum=D1DF243740112760AA0F76C8EB71B124BB6E4D2BF75F352322252E8A53C8ED2CC4A6A9A533C9281A42CF019046EF7BE91932C9590AD765FF997A258F1A8DA222 program=aqua program_version=2.53.9 registry_name=standard
time=2025-08-08T05:10:32Z level=fatal msg=aqua failed config_file_path=/home/runner/work/repo/repo/aqua.yaml env=linux/amd64 error=install packages: it failed to install some registries program=aqua program_version=2.53.9

How to reproduce

Sorry, but I believe this issue is caused by checksums previously recorded in aqua-checksums.json, so there is no way to newly reproduce it.

Expected behaviour

Success.

Actual behaviour

Checksum verification fails.

Note

Since this is occurring in a repository used for work, I cannot disclose many details.
If you need additional information, I will provide it as much as possible.
If you believe this issue is specific to my environment, please let me know.

[suzuki-shunsuke]

Thank you for reporting this issue.
We are intestigating this issue, but honestly we're not sure the cause.
So we'll really appreciate it if someone has some clue.
Thank you.

[suzuki-shunsuke]

Workaround

This is just a workaround, but you can disable the checksum verification until this issue will be resolved.

This workaround doesn't work because aqua can't get registries now.

[xpadev-net]

The registry.yaml on raw.githubusercontent.com is returning a 404 error, so there may be an issue on the GitHub side.

https://raw.githubusercontent.com/aquaproj/aqua-registry/refs/heads/main/registry.yaml
https://raw.githubusercontent.com/aquaproj/aqua-registry/refs/tags/v4.365.0/registry.yaml

[suzuki-shunsuke]

Thank you!
✅ I'll create a support ticket.

[suzuki-shunsuke]

Interesting.

⭕ https://raw.githubusercontent.com/aquaproj/aqua/refs/heads/main/.gitignore
❌ https://raw.githubusercontent.com/aquaproj/aqua-installer/refs/heads/main/.gitignore
❌ https://raw.githubusercontent.com/aquaproj/aqua-registry/refs/heads/main/.gitignore

[nemuvski]

I’m able to access the following URL without any issues:
https://raw.githubusercontent.com/aquaproj/aqua-registry/main/registry.yaml

Is this considered an incorrect URL format?
Sorry if this doesn’t have anything to do with it. 🙏

[suzuki-shunsuke]

Oh, thank you!
Interesting.

But seems like aqua doesn't set refs/{heads,tags}/ to download urls.

aqua/pkg/download/github_content.go

Lines 34 to 35 in 8982da8

	"https://raw.githubusercontent.com/%s/%s/%s/%s",
	param.RepoOwner, param.RepoName, param.Ref, param.Path,

[suzuki-shunsuke]

Hmm? https://raw.githubusercontent.com/aquaproj/aqua-installer/v4.0.2/aqua-installer returns old version.
This is apparently a bug of GitHub.

[csenet]

It seems that latest registry.yaml release from url is different from the registry.yaml unpacked from release page assets.
Maybe this cause checksum validation error?

❯ wget https://raw.githubusercontent.com/aquaproj/aqua-registry/v4.398.0/registry.yaml
❯ sha512 registry.yaml
SHA512 (registry.yaml) = da2eb0ea432f3eeb8039478b5e02e40c19268fec9097fbf0aabb54015ef2b13894bb4f253fc2fe2aaf39344952663cb4b93903bc3a746d1096267ec70d2fb01d
---
❯ wget https://github.com/aquaproj/aqua-registry/archive/refs/tags/v4.398.0.zip
❯ unzip v4.398.0.zip
❯ sha512 aqua-registry-4.398.0/registry.yaml
SHA512 (aqua-registry-4.398.0/registry.yaml) = 7ecb8d2982d9147b59b8ee0fd7f01eeaeaa542bc9ad2a6e57e3ff250cb9fa8233347cc963acc5be4e0527b4e6967da88613d99952b0bc42ccbe7c0fc60c562c5

[suzuki-shunsuke]

Hello Shunsuke Suzuki,

Thank you for bringing this issue with raw.githubusercontent.com URLs to our attention!

I've shared your detailed report with our engineering team for investigation. This appears to be affecting multiple users, and we're working to understand the root cause.

The correct format: For raw.githubusercontent.com URLs should not include the "refs/heads/" or "refs/tags/" portions. The proper formats are:
For branches: https://raw.githubusercontent.com/OWNER/REPO/BRANCH/PATH/TO/FILE
For tags/releases: https://raw.githubusercontent.com/OWNER/REPO/TAG/PATH/TO/FILE

As a workaround for the 404 errors you're experiencing, please try manually modifying your URLs to remove these segments. This should allow you to access the raw content directly.

I'll update you as soon as I have more information to share. In the meantime, if you discover any additional details or patterns related to this issue, please don't hesitate to share them.
All the best,
GitHub Support

[suzuki-shunsuke]

It seems that latest registry.yaml release from url is different from the registry.yaml unpacked from release page assets.
Maybe this cause checksum validation error?

Thank you. Interesting.

curl -LqO https://github.com/aquaproj/aqua-registry/archive/refs/tags/v4.398.0.zip
unzip v4.398.0.zip
curl -LqO https://raw.githubusercontent.com/aquaproj/aqua-registry/v4.398.0/registry.yaml
sha512 aqua-registry-4.398.0/registry.yaml registry.yaml

SHA512 (aqua-registry-4.398.0/registry.yaml) = 7ecb8d2982d9147b59b8ee0fd7f01eeaeaa542bc9ad2a6e57e3ff250cb9fa8233347cc963acc5be4e0527b4e6967da88613d99952b0bc42ccbe7c0fc60c562c5
SHA512 (registry.yaml) = bf5c8b2311fecabf1bad13026ef79c07a93461fbf0b53c84df6b6df83df8549c01aa17169b909cc0a1add7f4c6294fbda37867d158d7ea143238eb17dfbb6b8d

There are a lot of diff.

diff registry.yaml aqua-registry-4.398.0/registry.yaml

Seems like aqua-registry-4.398.0/registry.yaml is correct, but https://raw.githubusercontent.com/aquaproj/aqua-registry/v4.398.0/registry.yaml is wrong.

I'll share this with GitHub Support.

[suzuki-shunsuke]

Hello there,

Thank you for your follow-up and for reporting this additional issue with raw.githubusercontent.com URLs.

I've confirmed your finding regarding https://raw.githubusercontent.com/aquaproj/aqua-installer/v4.0.2/aqua-installer returning outdated content. This appears to be a content caching issue with raw.githubusercontent.com, which is related to but distinct from the 404 errors we discussed earlier.

Our investigation shows:
The tag v4.0.2 correctly points to a commit d1fe50798dbadd4eb5b98957290ca175f6b4870f containing bootstrap_version=v2.53.3 in the repository
However, raw.githubusercontent.com is incorrectly serving an older version with bootstrap_version=v2.37.2
As a workaround, you can access the correct content by using the direct commit hash instead of the tag name:
https://raw.githubusercontent.com/aquaproj/aqua-installer/d1fe50798dbadd4eb5b98957290ca175f6b4870f/aqua-installer

I've added this information to our ongoing investigation with the engineering team. They're looking into both the 404 errors and now this content caching issue as part of the same underlying problem.

I appreciate your patience as we work toward a resolution. If you encounter any other issues or have questions, please let me know.
All the best,
GitHub Support

[suzuki-shunsuke]

workaround

As a workaround, you can access the correct content by using the direct commit hash instead of the tag name:

As GitHub Support mentioned, seems like we can get the correct registry by specifying the full commit hash.

e.g. https://github.com/aquaproj/aqua-registry/releases/tag/v4.398.0

registries:
- type: standard
  # v4.398.0
  ref: 5ea884fb06c62d3e62892fa256a6aa9633ee24ec # renovate: depName=aquaproj/aqua-registry