slsa-verifier-linux-amd64: text file busy

[ianlewis]

aqua info

$ aqua info
{
  "version": "2.53.1",
  "commit_hash": "a8c17eb9e35245bdf6fc9505e75c86d225a87049",
  "os": "linux",
  "arch": "amd64",
  "pwd": "/home/(USER)/src/(USER)lewis/dotfiles",
  "root_dir": "/home/(USER)/.local/share/aquaproj-aqua",
  "env": {},
  "config_files": [
    {
      "path": "/home/(USER)/src/(USER)lewis/dotfiles/aqua.yaml"
    },
    {
      "path": "/home/(USER)/.aqua.yaml"
    }
  ]
}

Overview

When running aqua install on GitHub Actions with my dotfiles, I often get the following error. This happens on about 50%-75% of GHA runs. I think it may be some kind of concurrency bug but I'm not sure. It seems that aqua may be trying to change or move the slsa-verifier binary while it's running?

time=2025-0[6](https://github.com/ianlewis/dotfiles/actions/runs/15624686304/job/44016588464#step:4:7)-13T01:58:26Z level=info msg=download and unarchive the package env=linux/amd64 package_name=aqua-proxy package_version=v1.2.9 program=aqua program_version=2.53.1 registry=
time=2025-06-13T01:58:2[7](https://github.com/ianlewis/dotfiles/actions/runs/15624686304/job/44016588464#step:4:8)Z level=info msg=create a symbolic link env=linux/amd64 package_name=aqua-proxy package_version=v1.2.9 program=aqua program_version=2.53.1 registry=
time=2025-06-13T01:5[8](https://github.com/ianlewis/dotfiles/actions/runs/15624686304/job/44016588464#step:4:9):27Z level=info msg=create a symbolic link command=shellcheck env=linux/amd64 package_name=koalaman/shellcheck package_version=v0.10.0 program=aqua program_version=2.53.1
time=2025-06-13T01:58:27Z level=info msg=create a symbolic link command=actionlint env=linux/amd64 package_name=rhysd/actionlint package_version=v1.7.7 program=aqua program_version=2.53.1
time=2025-06-13T01:58:27Z level=info msg=create a symbolic link command=golangci-lint env=linux/amd64 package_name=golangci/golangci-lint package_version=v1.64.8 program=aqua program_version=2.53.1
time=2025-06-13T01:58:27Z level=info msg=create a symbolic link command=shfmt env=linux/amd64 package_name=mvdan/sh package_version=v3.11.0 program=aqua program_version=2.53.1
time=2025-06-13T01:58:27Z level=info msg=create a symbolic link command=selene env=linux/amd64 package_name=Kampfkarren/selene package_version=0.28.0 program=aqua program_version=2.53.1
time=2025-06-13T01:58:27Z level=info msg=create a symbolic link command=stylua env=linux/amd64 package_name=JohnnyMorganz/StyLua package_version=v2.0.2 program=aqua program_version=2.53.1
time=2025-06-13T01:58:27Z level=info msg=create a symbolic link command=rg env=linux/amd64 package_name=BurntSushi/ripgrep package_version=14.1.1 program=aqua program_version=2.53.1
time=2025-06-13T01:58:27Z level=info msg=create a symbolic link command=tofu env=linux/amd64 package_name=opentofu/opentofu package_version=v1.[9](https://github.com/ianlewis/dotfiles/actions/runs/15624686304/job/44016588464#step:4:10).0 program=aqua program_version=2.53.1
time=2025-06-13T01:58:27Z level=info msg=create a symbolic link command=fzf env=linux/amd64 package_name=junegunn/fzf package_version=v0.62.0 program=aqua program_version=2.53.1
time=2025-06-13T01:58:27Z level=info msg=create a symbolic link command=gh env=linux/amd64 package_name=cli/cli package_version=v2.70.0 program=aqua program_version=2.53.1
time=2025-06-13T01:58:27Z level=info msg=create a symbolic link command=todos env=linux/amd64 package_name=ianlewis/todos package_version=v0.13.0 program=aqua program_version=2.53.1
time=2025-06-13T01:58:27Z level=info msg=create a symbolic link command=slsa-verifier env=linux/amd64 package_name=slsa-framework/slsa-verifier package_version=v2.7.0 program=aqua program_version=2.53.1
time=2025-06-13T01:58:27Z level=info msg=create a symbolic link command=cosign env=linux/amd64 package_name=sigstore/cosign package_version=v2.5.0 program=aqua program_version=2.53.1
time=2025-06-13T01:58:27Z level=info msg=download and unarchive the package env=linux/amd64 package_name=Kampfkarren/selene package_version=0.28.0 program=aqua program_version=2.53.1 registry=standard
time=2025-06-13T01:58:27Z level=info msg=download and unarchive the package env=linux/amd64 package_name=koalaman/shellcheck package_version=v0.[10](https://github.com/ianlewis/dotfiles/actions/runs/15624686304/job/44016588464#step:4:11).0 program=aqua program_version=2.53.1 registry=standard
time=2025-06-13T01:58:27Z level=info msg=download and unarchive the package env=linux/amd64 package_name=golangci/golangci-lint package_version=v1.64.8 program=aqua program_version=2.53.1 registry=standard
time=2025-06-13T01:58:27Z level=info msg=download and unarchive the package env=linux/amd64 package_name=mvdan/sh package_version=v3.[11](https://github.com/ianlewis/dotfiles/actions/runs/15624686304/job/44016588464#step:4:12).0 program=aqua program_version=2.53.1 registry=standard
time=2025-06-13T01:58:27Z level=info msg=download and unarchive the package env=linux/amd64 package_name=rhysd/actionlint package_version=v1.7.7 program=aqua program_version=2.53.1 registry=standard
time=2025-06-13T01:58:28Z level=info msg=download and unarchive the package env=linux/amd64 package_name=JohnnyMorganz/StyLua package_version=v2.0.2 program=aqua program_version=2.53.1 registry=standard
time=2025-06-13T01:58:28Z level=info msg=download and unarchive the package env=linux/amd64 package_name=BurntSushi/ripgrep package_version=14.1.1 program=aqua program_version=2.53.1 registry=standard
time=2025-06-13T01:58:28Z level=info msg=download and unarchive the package env=linux/amd64 package_name=opentofu/opentofu package_version=v1.9.0 program=aqua program_version=2.53.1 registry=standard
time=2025-06-13T01:58:28Z level=info msg=download and unarchive the package env=linux/amd64 package_name=junegunn/fzf package_version=v0.62.0 program=aqua program_version=2.53.1 registry=standard
time=2025-06-13T01:58:28Z level=info msg=download and unarchive the package env=linux/amd64 package_name=cli/cli package_version=v2.70.0 program=aqua program_version=2.53.1 registry=standard
time=2025-06-13T01:58:28Z level=info msg=download and unarchive the package env=linux/amd64 package_name=ianlewis/todos package_version=v0.13.0 program=aqua program_version=2.53.1 registry=standard
time=2025-06-13T01:58:28Z level=info msg=download and unarchive the package env=linux/amd64 package_name=slsa-framework/slsa-verifier package_version=v2.7.0 program=aqua program_version=2.53.1 registry=standard
time=2025-06-13T01:58:28Z level=info msg=download and unarchive the package env=linux/amd64 package_name=sigstore/cosign package_version=v2.5.0 program=aqua program_version=2.53.1 registry=standard
time=2025-06-13T01:58:28Z level=info msg=verify a package with slsa-verifier env=linux/amd64 package_name=ianlewis/todos package_version=v0.13.0 program=aqua program_version=2.53.1 registry=standard
time=2025-06-13T01:58:28Z level=info msg=download and unarchive the package env=linux/amd64 package_name=slsa-framework/slsa-verifier package_version=v2.7.0 program=aqua program_version=2.53.1 registry=
time=2025-06-13T01:58:29Z level=info msg=verify a package with slsa-verifier env=linux/amd64 package_name=slsa-framework/slsa-verifier package_version=v2.7.0 program=aqua program_version=2.53.1 registry=standard
time=2025-06-13T01:58:29Z level=info msg=verify GitHub Artifact Attestations env=linux/amd64 package_name=cli/cli package_version=v2.70.0 program=aqua program_version=2.53.1 registry=standard
time=2025-06-13T01:58:29Z level=info msg=download and unarchive the package env=linux/amd64 package_name=cli/cli package_version=v2.74.0 program=aqua program_version=2.53.1 registry=
Verified signature against tlog entry index 169679096 at URL: https://rekor.sigstore.dev/api/v1/log/entries/108e9186e8c5677af62eb[12](https://github.com/ianlewis/dotfiles/actions/runs/15624686304/job/44016588464#step:4:13)d269d15ef29fe221e7b73a2ed1eccba714b967f27632dc2c511ed0a5f
Verified build using builder "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@refs/tags/v2.0.0" at commit 6657aada084353c65e5dde35394b1a010289fab0

Verifying artifact /tmp/060523960: PASSED

PASSED: SLSA verification passed
time=2025-06-[13](https://github.com/ianlewis/dotfiles/actions/runs/15624686304/job/44016588464#step:4:14)T01:58:30Z level=error msg=install the package env=linux/amd64 error=open the file (/home/runner/.local/share/aquaproj-aqua/pkgs/github_release/github.com/slsa-framework/slsa-verifier/v2.7.0/slsa-verifier-linux-amd64/slsa-verifier-linux-amd64): open /home/runner/.local/share/aquaproj-aqua/pkgs/github_release/github.com/slsa-framework/slsa-verifier/v2.7.0/slsa-verifier-linux-amd64/slsa-verifier-linux-amd64: text file busy package_name=slsa-framework/slsa-verifier package_version=v2.7.0 program=aqua program_version=2.53.1 registry=standard
Verified build using builder "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@refs/tags/v2.1.0" at commit c541b34b863a2c82d59da3cd50658d7d636ff39a
Verifying artifact /tmp/084938365: PASSED

PASSED: SLSA verification passed
time=2025-06-13T01:58:33Z level=fatal msg=aqua failed env=linux/amd64 error=it failed to install some packages program=aqua program_version=2.53.1

How to reproduce

aqua.yaml

---
# Copyright 2025 Ian Lewis
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# yaml-language-server: $schema=https://raw.githubusercontent.com/aquaproj/aqua/main/json-schema/aqua-yaml.json
# aqua - Declarative CLI Version Manager
# https://aquaproj.github.io/
checksum:
  enabled: true
  require_checksum: true
  supported_envs:
    - all
registries:
  - type: standard
    ref: v4.367.0 # renovate: depName=aquaproj/aqua-registry
packages:
  - name: koalaman/shellcheck@v0.10.0
  - name: rhysd/actionlint@v1.7.7
  - name: golangci/golangci-lint@v1.64.8
  - name: mvdan/sh@v3.11.0
  - name: Kampfkarren/selene@0.28.0
  - name: JohnnyMorganz/StyLua@v2.0.2
  - name: BurntSushi/ripgrep@14.1.1
  - name: opentofu/opentofu@v1.9.0
  - name: junegunn/fzf@v0.62.0
  - name: cli/cli@v2.70.0
  - name: ianlewis/todos@v0.13.0
  - name: slsa-framework/slsa-verifier@v2.7.0
  - name: sigstore/cosign@v2.5.0

Other related code such as local Registry

n/a

Executed command and output

$ aqua --config aqua/aqua.yaml install

Expected behaviour

I would expect that aqua install would complete successfully the vast majority of the time.

Actual behaviour

Aqua fails with "it failed to install some packages"

Note

No response

[suzuki-shunsuke]

Thank you for reporting this issue.
I haven't seen the error. I'll take a look.

aqua installs tools in parallel, and multiple tools depend on slsa-verifier.

  - name: ianlewis/todos@v0.13.0
  - name: slsa-framework/slsa-verifier@v2.7.0

• https://github.com/aquaproj/aqua-registry/blob/5c18cbcf68024f6cd3678b0049f31105863e1877/pkgs/ianlewis/todos/registry.yaml#L26-L28
• https://github.com/aquaproj/aqua-registry/blob/5c18cbcf68024f6cd3678b0049f31105863e1877/pkgs/slsa-framework/slsa-verifier/registry.yaml#L39-L41

aqua tries to install slsa-verifier twice for them in parallel, so I guess this causes this failure.

Workaround

1. Install aqua by aqua-installer
2. Install either todos or slsa-verifier by lazy install

1. Install aqua by aqua-installer

https://aquaproj.github.io/docs/products/aqua-installer#github-actions

Seems like you don't install aqua using aqua-installer because aqua_version isn't outputted in the log.
If you install aqua by aqua-installer, slsa-verifier v2.7.0 is installed while installing aqua, so you can avoid the error.

aqua/pkg/slsa/aqua.yaml

Line 14 in d9db116

- name: slsa-framework/slsa-verifier@v2.7.0

Tip

aqua-installer installs aqua securely.
https://aquaproj.github.io/docs/products/aqua-installer/bootstrap

2. Install either todos or slsa-verifier by lazy install

slsa-verifier --help # Install slsa-verifier v2.7.0 by lazy install
aqua install

By installing slsa-vefier by lazy install before running aqua install, you can avoid the error.

[suzuki-shunsuke]

BTW, --config aqua/aqua.yaml is unnecessary because it's included in the default paths where aqua looks for.

aqua --config aqua/aqua.yaml install

https://aquaproj.github.io/docs/reference/config/#configuration-file-path

[ianlewis]

Thanks! To be clear, I haven't been able to reproduce this locally. I only see it in my GitHub Actions runs.

https://github.com/ianlewis/dotfiles/actions/runs/15790659369/job/44515708121

---

BTW, --config aqua/aqua.yaml is unnecessary because it's included in the default paths where aqua looks for.

aqua --config aqua/aqua.yaml install

I do this because it seems that aqua will look for aqua.yaml files in parent directories if I don't specify --config. I only want it to look at this one file in this case (I realize it's a niche use-case).