admin/brew
1
0
Fork 0
Code Issues Packages Projects Releases 6 Wiki Activity

attestation: disable if gh is too old

Browse Source 
Signed-off-by: William Woodruff <william@yossarian.net>
This commit is contained in:
William Woodruff 2024-08-12 14:54:55 -04:00
parent e66df8cfb1
commit 30acccf4b3
No known key found for this signature in database
1 changed files with 4 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
Library/Homebrew/attestation.rb
View File

@ -52,12 +52,6 @@ module Homebrew
# @api private # @api private
class GhAuthInvalid < RuntimeError; end class GhAuthInvalid < RuntimeError; end
# Raised if the version of `gh` invoked is too old to support
# attestations.
#
# @api private
class GhTooOld < RuntimeError; end
# Returns whether attestation verification is enabled. # Returns whether attestation verification is enabled.
# #
# @api private # @api private
@ -68,6 +62,9 @@ module Homebrew
return false if ENV.fetch("CI", false) return false if ENV.fetch("CI", false)
return false if OS.unsupported_configuration? return false if OS.unsupported_configuration?
gh_version = Formula["gh"].any_installed_version
return false if gh_version.nil? || gh_version < "2.49"
# Always check credentials last to avoid unnecessary credential extraction. # Always check credentials last to avoid unnecessary credential extraction.
(Homebrew::EnvConfig.developer? || Homebrew::EnvConfig.devcmdrun?) && GitHub::API.credentials.present? (Homebrew::EnvConfig.developer? || Homebrew::EnvConfig.devcmdrun?) && GitHub::API.credentials.present?
end end
@ -84,7 +81,7 @@ module Homebrew
# to prevent a cycle during bootstrapping. This can eventually be resolved # to prevent a cycle during bootstrapping. This can eventually be resolved
# by vendoring a pure-Ruby Sigstore verifier client. # by vendoring a pure-Ruby Sigstore verifier client.
with_env(HOMEBREW_NO_VERIFY_ATTESTATIONS: "1") do with_env(HOMEBREW_NO_VERIFY_ATTESTATIONS: "1") do
@gh_executable = ensure_executable!("gh", reason: "verifying attestations", latest: true) @gh_executable = ensure_formula_installed!("gh", reason: "verifying attestations", latest: true).opt_bin/"gh"
end end
T.must(@gh_executable) T.must(@gh_executable)
@ -149,11 +146,6 @@ module Homebrew
raise MissingAttestationError, "attestation not found: #{e}" if e.stderr.include?("HTTP 404: Not Found") raise MissingAttestationError, "attestation not found: #{e}" if e.stderr.include?("HTTP 404: Not Found")
if e.stderr.include?("unknown command \"attestation\" for \"gh\"")
raise GhTooOld,
"your version of `gh` is too old; run `brew upgrade gh` to continue"
end
raise InvalidAttestationError, "attestation verification failed: #{e}" raise InvalidAttestationError, "attestation verification failed: #{e}"
end end