From 1b8a8a090217e4412d198053aae0f72b212e39c8 Mon Sep 17 00:00:00 2001 From: Bo Anderson Date: Tue, 30 Jul 2024 04:51:29 +0100 Subject: [PATCH] attestation: only extract credentials when necessary --- Library/Homebrew/attestation.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Library/Homebrew/attestation.rb b/Library/Homebrew/attestation.rb index c6808e68db..853643465f 100644 --- a/Library/Homebrew/attestation.rb +++ b/Library/Homebrew/attestation.rb @@ -59,11 +59,11 @@ module Homebrew def self.enabled? return false if Homebrew::EnvConfig.no_verify_attestations? return true if Homebrew::EnvConfig.verify_attestations? - return false if GitHub::API.credentials.blank? return false if ENV.fetch("CI", false) return false if OS.unsupported_configuration? - Homebrew::EnvConfig.developer? || Homebrew::EnvConfig.devcmdrun? + # Always check credentials last to avoid unnecessary credential extraction. + (Homebrew::EnvConfig.developer? || Homebrew::EnvConfig.devcmdrun?) && GitHub::API.credentials.present? end # Returns a path to a suitable `gh` executable for attestation verification.