- `zap :not_required` declares that a cask has nothing to zap in a way
that can be audited, unlike the comment that ~2,900 casks use.
- Add `Cask/ZapNotRequired` to autocorrect the comment so taps can
migrate with `brew style --fix`.
- Leave comments that give a reason, as autocorrecting would lose it,
and comments after code, as the stanza can't go on that line.
- Keep `HOMEBREW_SUDO_THROUGH_SUDO_USER` and the original caller
available after the wrappers clear their environment.
- Let `as-brew-user` and `as-console-user` use existing sudoers policy
for privileged cask operations.
- Handle same-user routing without changing normal service domains.
- Document that the setting does not change sudo's authentication
requirements.
Fixes#24358
If search output is piped to another command, the headers are
suppressed and each package name is printed on a separate line.
As a user, I had no idea that the headers were suppressed until
I looked through the code, so I enabled --quiet flag to force
the same behavior.
- Changing directory inside `as-brew-user` and `as-console-user` makes
relative paths resolve against the target user's home, breaking
`bundle --file` and local `Brewfile` discovery.
- Setting `HOME` is enough to use the target user's configuration
and caches. Keeping the caller's directory fixes relative paths for
every command without duplicating argument parsing in the wrappers.
Fixes#24359
- To make AppImage casks on Linux appear in the desktop application
menu, install each root-level embedded desktop entry into
`${HOMEBREW_XDG_DATA_HOME:-~/.local/share}/applications`.
- Keep the entry's filename so URL handlers, dock pins and notifications
that look up the app's desktop ID keep working.
- Add `Cask::DesktopFileParser` to parse and manipulate desktop files.
- Point every `Exec` at the AppImage through `env DESKTOPINTEGRATION=1`,
keeping its variables and arguments.
- Point `Icon` at the named icon copied into the versioned Caskroom,
falling back to `.DirIcon`.
- Track ownership with Caskroom symlinks, fail on an existing entry
unless `--force` or `--adopt`, and rewrite it on upgrade.
- Explain shared Brewfiles for teams without device management.
- Connect existing commands to MDM deployment and reporting.
- Document provisioning prerequisites, package policies and scan coverage.
- Link administration workflows from the Mac administrator guide.
- Match implicit trust to the documented installation behaviour.
Other commands require existing trust for the tap or item.
- Retain the dispatched name in `Homebrew.running_command` and limit
`ARGV` allowances to `install`, `reinstall` and `upgrade`, which
announce and persist item trust.
- Preserve early formula loading for command-specific options before
`trust_fully_qualified_items!` runs.
- Cover formula and cask loads, both `--tap` forms and existing alias,
rename and external command behaviour.
- Let archive tools read files in the sandbox's temporary directory
without granting read access to its parent.
- Exercise temporary-file reads and denied parent access in the sandbox.
Fixes#24348
- Extract InfluxDB queries so API generators can call Ruby directly.
- Share cached package totals between `brew info` and API generation.
- Keep query formatting and reader tests with their implementations.
- Prefer newer working Homebrew or system Git and curl before a path
suggestion, so overrides cannot displace suitable defaults. Share
selection with Subversion when it is invoked.
- Cache probes against executable metadata and selection inputs to
avoid repeated version checks. Read cache data without sourcing shell
code and pass Bash's known curl version and path to Ruby for reuse.
- Preserve system curl suitability across cached and forced selections
so legacy remote updates and certificate checks remain correct.
Keep TLS verification enabled when a suitable custom curl is selected.
- Check Git and curl in `brew doctor`. Invalidate failed cached
selections and reselect for one retry, refreshing Ruby's cached data
so subsequent checks use the working replacement.
- Limit invalidation for command failures to explicit version checks.
Refresh after installation and preserve ordinary download errors
without retrying downloads or wrapping every invocation.
- Attempt installation when Git/curl are unsuitable or explicitly
forced. Prevent recursive startup and recheck the result before
reporting the minimum, observed versions and executable paths.
- Retain version floors and document paths as suggestions without
promising a fixed selection order, allowing policy to evolve.
- Validate ELF loader strings as UTF-8 before checking paths, so
valid non-ASCII references reach bottle relocation detection.
- Keep rejecting invalid byte sequences and cover loader paths
and the binary relocation metadata produced by `brew bottle`.
- Apple's `strings` under brew's UTF-8 locale can report a high byte
just before an embedded path as part of the same run.
- `text_matches_in_file` then fails `File.exist?` on the joined string
and drops the match, so `brew bottle` can mark a keg that embeds its
Cellar path as `cellar: :any`.
- Strip those bytes rather than running `strings` with `LC_ALL=C`,
which would split prefixes containing non-ASCII characters.
- Pass `-e S` to GNU `strings` on Linux, which otherwise splits
those prefixes and misses them in text files.
- `Keg#link_dir` and `Keg#unlink` called `relative_path_from` on every
path `find` yielded and `make_relative_symlink` once more per link.
Ruby's method cleans both paths and walks them a component at a time,
which made it a large part of linking and unlinking big kegs.
- Add `Utils::Path.relative_path_from` for these calls. For clean
absolute paths it slices the base off a path below it and compares
components otherwise, leaving anything else to Ruby's method.
- `Keg#unlink` checks `symlink?` before `directory?`, so each linked
file takes one `lstat` rather than an `lstat` and a `stat`.
When stdout is not a TTY (or with `--verbose`), `brew list --cask NAME`
ran `find` on the Caskroom path even if the cask was not installed, so
it failed with a `find` execution error instead of the
"Cask 'NAME' is not installed." error the TTY path gives.
Raise `CaskNotInstalledError` before running `find`, as
`Cask::List.list_casks` does.
- `gktool scan` prints `\r`-separated `Progress:` counters before its
verdict, so for large bundles the signing failure message is almost
all progress
- GitHub truncates annotations at 4096 characters, so CI never showed
why Gatekeeper rejected the cask
- `Tty.size`, `Tty.width` and `Tty.height` cache the first terminal
size they read, so shrinking the window mid-download left progress
lines padded to the old width. They then wrapped and every redraw
started lower than the last, leaving stale frames behind.
- Mark the cached size as stale on `SIGWINCH` and drop it on the next
read, so a resize that lands during a read isn't lost.
- Retry a failed terminal size probe rather than caching `nil`.
- When the width changes, clear below the frame top on the next
redraw to remove rows left when the terminal rewraps the old frame.
Fixes#24333
- `keep_alive successful_exit: false` makes launchd restart a service
that exits unsuccessfully, but `to_systemd_unit` only handled `true`
values so these units had no `Restart=` line at all.
- Map it to `Restart=on-failure`, the inverse of `on-success`, using
the same `key?(:successful_exit)` check as `to_plist`.
- Sandboxed private source downloads cannot read tokens stored by `gh`
in the macOS Keychain. Allowing Keychain access would also expose
unrelated credentials, so retain the existing sandbox restrictions.
- Reuse `GitHub::API.github_cli_token` outside the sandbox for built-in
Git strategies when the rewritten URL uses HTTPS on `github.com`
and a credential helper is configured. Bound the lookup and keep
configured helpers inside the sandbox, including wrappers of `gh`.
- Pass the result as `GH_TOKEN` only to top-level clones, fetches and
remote branch discovery. Register it for log redaction without
setting the parent environment or populating the API credential
cache, avoiding exposure through formula environment variables.
- Disable implicit submodule recursion even when Git configuration
enables it, so child downloads cannot inherit the top-level token.
Fetch submodules separately without it. Checkouts, resets and local
inspections also receive no injected token. Share the recursion flag,
working-directory selection and timeout conversion across callers.
- Explain why tap operations can use Keychain helpers while source
downloads cannot, and document the remaining authentication limits
for private submodules and partial clones that fetch during checkout.
Fixes#24339
Mike McQuaid