- Keep `HOMEBREW_SUDO_THROUGH_SUDO_USER` and the original caller
available after the wrappers clear their environment.
- Let `as-brew-user` and `as-console-user` use existing sudoers policy
for privileged cask operations.
- Handle same-user routing without changing normal service domains.
- Document that the setting does not change sudo's authentication
requirements.
Fixes#24358
- Changing directory inside `as-brew-user` and `as-console-user` makes
relative paths resolve against the target user's home, breaking
`bundle --file` and local `Brewfile` discovery.
- Setting `HOME` is enough to use the target user's configuration
and caches. Keeping the caller's directory fixes relative paths for
every command without duplicating argument parsing in the wrappers.
Fixes#24359
- Explain shared Brewfiles for teams without device management.
- Connect existing commands to MDM deployment and reporting.
- Document provisioning prerequisites, package policies and scan coverage.
- Link administration workflows from the Mac administrator guide.
- Match implicit trust to the documented installation behaviour.
Other commands require existing trust for the tap or item.
- Retain the dispatched name in `Homebrew.running_command` and limit
`ARGV` allowances to `install`, `reinstall` and `upgrade`, which
announce and persist item trust.
- Preserve early formula loading for command-specific options before
`trust_fully_qualified_items!` runs.
- Cover formula and cask loads, both `--tap` forms and existing alias,
rename and external command behaviour.
- Let archive tools read files in the sandbox's temporary directory
without granting read access to its parent.
- Exercise temporary-file reads and denied parent access in the sandbox.
Fixes#24348
- Extract InfluxDB queries so API generators can call Ruby directly.
- Share cached package totals between `brew info` and API generation.
- Keep query formatting and reader tests with their implementations.
- Prefer newer working Homebrew or system Git and curl before a path
suggestion, so overrides cannot displace suitable defaults. Share
selection with Subversion when it is invoked.
- Cache probes against executable metadata and selection inputs to
avoid repeated version checks. Read cache data without sourcing shell
code and pass Bash's known curl version and path to Ruby for reuse.
- Preserve system curl suitability across cached and forced selections
so legacy remote updates and certificate checks remain correct.
Keep TLS verification enabled when a suitable custom curl is selected.
- Check Git and curl in `brew doctor`. Invalidate failed cached
selections and reselect for one retry, refreshing Ruby's cached data
so subsequent checks use the working replacement.
- Limit invalidation for command failures to explicit version checks.
Refresh after installation and preserve ordinary download errors
without retrying downloads or wrapping every invocation.
- Attempt installation when Git/curl are unsuitable or explicitly
forced. Prevent recursive startup and recheck the result before
reporting the minimum, observed versions and executable paths.
- Retain version floors and document paths as suggestions without
promising a fixed selection order, allowing policy to evolve.
- Sandboxed private source downloads cannot read tokens stored by `gh`
in the macOS Keychain. Allowing Keychain access would also expose
unrelated credentials, so retain the existing sandbox restrictions.
- Reuse `GitHub::API.github_cli_token` outside the sandbox for built-in
Git strategies when the rewritten URL uses HTTPS on `github.com`
and a credential helper is configured. Bound the lookup and keep
configured helpers inside the sandbox, including wrappers of `gh`.
- Pass the result as `GH_TOKEN` only to top-level clones, fetches and
remote branch discovery. Register it for log redaction without
setting the parent environment or populating the API credential
cache, avoiding exposure through formula environment variables.
- Disable implicit submodule recursion even when Git configuration
enables it, so child downloads cannot inherit the top-level token.
Fetch submodules separately without it. Checkouts, resets and local
inspections also receive no injected token. Share the recursion flag,
working-directory selection and timeout conversion across callers.
- Explain why tap operations can use Keychain helpers while source
downloads cannot, and document the remaining authentication limits
for private submodules and partial clones that fetch during checkout.
Fixes#24339
- Preserve user Git configuration and download permissions to avoid
breaking private repository authentication.
- Run one bounded Git configuration query in `brew doctor` without
executing credential helpers or contacting remotes.
- Match Git diagnostics against sandbox rules to identify restricted
paths without printing raw configuration or error output.
- Share the download environment and sandbox policy without creating
a download strategy instance for the diagnostic.
- Use Git's exit status and report sandbox setup failures without
aborting subsequent doctor checks.
- Share curl configuration, retries and verbosity across shell downloads.
- Preserve curlrc disabling when certificate options are injected.
- Keep config and cache paths intact and load each config once.
- Enforce HTTPS redirects for shell downloads when requested.
- Apply configured options to the TLS capability probe.
- Clarify that Git fetches use Git's own transport and configuration.
Fixes#24322
- `https://www.macports.org` returns HTTP 503, failing the HTMLProofer
docs check.
- Extend the existing `build.macports.org` ignore rather than adding a
second entry; drop it once MacPorts is reliably back.
- Share a private `0700` directory for one cask operation so sandbox
cleanup cannot delete data awaiting restoration.
- Fail if a recorded backup disappears before guarded restoration.
- Retain the directory on failure and report its path for recovery.
- Keep command scratch space isolated and clean up after success.
Fixes#24293
- Preserve an explicit `--require-sha` when `--force` is also passed,
including when the environment enables the same policy.
- Allow `--force` to override an environment-only checksum requirement
during install, reinstall and upgrade.
- Reject unchecked archives, resources and external patches, including
cached downloads, unless installing without the API.
- Audit patches, versioned HEAD resources and full stable Git revisions
across all taps; reject unverifiable stable sources in official taps.
- Stage third-party checksum and stable VCS strategy deprecations for
the next major release while preserving moving HEAD sources.
- Require signed metadata digests for fresh and cached patch files,
including resource patches, before using them in source builds.
- Deploy after the API publishes local patch checksums; old metadata
requires an update rather than silently trusting raw file downloads.
- Generate digests for stable, HEAD and resource patch files without
adding checksums to formula definitions.
- Preserve the digests through the public and internal API formats.
- Reject unreadable patches during API generation before incomplete
metadata can be published.
- Stringify `BuildError` commands and arguments so JSON reporting
preserves the original failure when formulae pass `Pathname`s.
- Assert reconstructed fields so error equality cannot hide data loss.
Fixes#24291
- Verify cached bottles when provenance checks are enabled.
- Bind the expected subject name to the downloaded bottle's digest.
- Require an exact package version when matching `all` bottles.
- Reserve space for names, arrows and download sizes in install and
upgrade summaries.
- Retain at least 11 version characters before an ellipsis so narrow
terminals still show useful versions.
- Keep full version strings when output is redirected.
- Document descriptive names for numeric values in `AGENTS.md`.
- Fetch fresh bodies when ETags are missing or belong to another URL.
- Stage downloads and share a lock across Ruby and Bash to preserve
cache bodies and validators on failed or concurrent downloads.
- Parse HTTP status with old curl and retry conditional receive errors.
- Preserve pending ETag writes when cached reads skip downloads.
- Recheck curl support instead of trusting an inherited flag.
- macOS TCC can attribute a command-line child's protected-resource
accesses to the application responsible for launching it. A terminal
with Full Disk Access can therefore lend that access to package code
run by Homebrew. Seatbelt restrictions and TCC attribution are
separate controls, so disclaim responsibility to reduce the authority
inherited by workers even where the sandbox permits a file read.
- Apply this at the shared macOS `sandbox_command` boundary because
build scripts, tests and archive-processing tools can access protected
data too. Limiting it to starting or restarting `.app` bundles would
miss those workers. Cover sandboxed formula and cask operations and
document the shared protection in the supply-chain security guide.
- Use `responsibility_spawnattrs_setdisclaim`, a private `libSystem`
API, to set responsibility on the spawn attributes. No documented
public equivalent is known for arbitrary command-line workers.
Public Launch Services app launching is not a drop-in replacement for
Homebrew's synchronous workers and their inherited descriptors.
LLDB and Chromium use the same private call, but Apple provides no
public compatibility contract for it and may change or remove it.
- Resolve the private symbol dynamically through Ruby's `Fiddle` so
its absence can be handled at runtime without a compiled helper or
private SDK headers. Use public `posix_spawn` APIs for the remaining
setup and Darwin's `POSIX_SPAWN_SETEXEC` to replace the launcher.
Because `posix_spawn` only returns on failure with this flag, always
raise the returned native error.
Keeping its PID preserves signal forwarding and timeout handling;
retaining descriptors preserves terminal and captured output paths.
Pass arguments and the environment directly without shell parsing.
- Treat disclaiming as an additional, optional protection. If the
symbol is missing or the private call rejects the request, warn and
execute the same `sandbox-exec` command with the same profile. This
preserves existing sandbox restrictions without making Homebrew
unusable when a private API changes, although the launching app's
privacy permissions may then apply. Fail on native setup or spawn
errors rather than concealing failures unrelated to the private API.
- Disclaiming does not revoke privacy grants made directly to a worker
executable. Vendor installers that run outside Homebrew's sandbox
are outside this boundary. Symbol detection and return-code checks
also cannot detect future changes to the private API's semantics.
- Require self-responsibility only when no fallback warning was emitted.
An inherited responsible PID is valid when disclaiming is unavailable.
Keep PID preservation mandatory and exercise the real fallback through
both interactive and captured launch paths so optional API support
does not become a requirement of the test suite.
- Cover the fallback paths, argument handling and native failures in
unit tests. Native checks use the separate private query
`responsibility_get_pid_responsible_for_pid` to inspect responsibility
and verify PID preservation; that query is only a test dependency.
These checks do not prove actual TCC access decisions: validating
protected-file access from a terminal with Full Disk Access remains
necessary outside the enclosing development sandbox.
- Keep next-period PRs out of contribution totals, including capped
repository searches.
- Use the adjusted boundary in cache keys to avoid stale results.
Mike McQuaid