[Homebrew/Security] Keep Formula runtime packages in one verified generation - #1084
Merged
brandonpayton merged 1 commit intoJul 24, 2026
Merged
Conversation
…tests Carry complete content-addressed package generations into the read-only Formula runtime instead of flattening resolver mirrors into identityless files. Share the portable staging helper with prepared CI workspaces, bind tap runners to the authenticated cache root, and make materialization the verifier’s final binaries writer. Harden the replacement transaction against partial backup deletion and cover noncanonical links, escaping generation content, relocation, order changes, and rollback failures.
This was referenced Jul 24, 2026
[Homebrew/Security] Pin publication to the portable-cache publisher
kandelo-dev/homebrew-tap-core#99
Merged
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Formula tests run as an isolated user against a read-only Kandelo checkout. The publisher was copying only the resolved executable bytes into that checkout. That made the executables readable, but it discarded the package-generation identity used by the resolver to prevent unrelated package builds from being mixed together.
A fresh Asa canary exposed the problem when its test needed
/bin/sh: Dash had been fetched, but its flattened mirror was correctly rejected as an identityless source-checkout file.What changes
.ci-test-binary-cachebesidebinaries/.binaries/.Validation
bash scripts/test-materialize-resolver-binaries.sh.github/actions/detect-change-scope/test-ci-scope-paths.shtests/scripts/ci-run-test-suite-groups.test.shhost/test/binary-resolver.test.ts: 68 tests passed, including relocationscripts/check-homebrew-publish-workflow-trust.rbscripts/test-homebrew-publish-workflow.shgit diff --checkThe rollback suite includes injected original-rename and partial-backup-deletion failures. The trust suite enforces that no package resolver rewrites
binaries/between portable-cache materialization and isolated verification.Rollout
This is stacked on #1082 because it relies on the root-owned checker and authenticated source-root boundary introduced there. Before changing the tap publisher pin, the exact head still needs the privileged Ubuntu preflight. A fresh Asa canary will then prove source build, Formula test, public bottle/index publication, anonymous pour, and immutable VFS finalization end to end.