diff --git a/Library/Homebrew/bintray.rb b/Library/Homebrew/bintray.rb
index 7277cfdebc..c925c1260d 100644
--- a/Library/Homebrew/bintray.rb
+++ b/Library/Homebrew/bintray.rb
@@ -11,6 +11,7 @@ class Bintray
   extend T::Sig
 
   include Context
+  include Utils::Curl
 
   API_URL = "https://api.bintray.com"
 
@@ -22,6 +23,7 @@ class Bintray
     "#<Bintray: org=#{@bintray_org}>"
   end
 
+  sig { params(org: T.nilable(String)).void }
   def initialize(org: "homebrew")
     @bintray_org = org
 
@@ -30,9 +32,7 @@ class Bintray
     ENV["HOMEBREW_FORCE_HOMEBREW_ON_LINUX"] = "1" if @bintray_org == "homebrew" && !OS.mac?
   end
 
-  def open_api(url, *extra_curl_args, auth: true)
-    args = extra_curl_args
-
+  def open_api(url, *args, auth: true)
     if auth
       raise UsageError, "HOMEBREW_BINTRAY_USER is unset." unless (user = Homebrew::EnvConfig.bintray_user)
       raise UsageError, "HOMEBREW_BINTRAY_KEY is unset." unless (key = Homebrew::EnvConfig.bintray_key)
@@ -40,11 +40,18 @@ class Bintray
       args += ["--user", "#{user}:#{key}"]
     end
 
-    curl(*args, url,
-         print_stdout: false,
-         secrets:      key)
+    curl(*args, url, print_stdout: false, secrets: key)
   end
 
+  sig do
+    params(local_file:    String,
+           repo:          String,
+           package:       String,
+           version:       String,
+           remote_file:   String,
+           sha256:        T.nilable(String),
+           warn_on_error: T.nilable(T::Boolean)).void
+  end
   def upload(local_file, repo:, package:, version:, remote_file:, sha256: nil, warn_on_error: false)
     unless File.exist? local_file
       msg = "#{local_file} for upload doesn't exist!"
@@ -59,24 +66,30 @@ class Bintray
     args = ["--upload-file", local_file]
     args += ["--header", "X-Checksum-Sha2: #{sha256}"] unless sha256.blank?
     args << "--fail" unless warn_on_error
-    result = open_api(url, *args)
+
+    result = T.unsafe(self).open_api(url, *args)
 
     json = JSON.parse(result.stdout)
-    if json["message"] != "success"
-      msg = "Bottle upload failed: #{json["message"]}"
-      raise msg unless warn_on_error
+    return if json["message"] == "success"
 
-      opoo msg
-    end
+    msg = "Bottle upload failed: #{json["message"]}"
+    raise msg unless warn_on_error
 
-    result
+    opoo msg
   end
 
+  sig do
+    params(repo:          String,
+           package:       String,
+           version:       String,
+           file_count:    T.nilable(Integer),
+           warn_on_error: T.nilable(T::Boolean)).void
+  end
   def publish(repo:, package:, version:, file_count:, warn_on_error: false)
     url = "#{API_URL}/content/#{@bintray_org}/#{repo}/#{package}/#{version}/publish"
     upload_args = %w[--request POST]
-    upload_args << "--fail" unless warn_on_error
-    result = open_api(url, *upload_args)
+    upload_args += ["--fail"] unless warn_on_error
+    result = T.unsafe(self).open_api(url, *upload_args)
     json = JSON.parse(result.stdout)
     if file_count.present? && json["files"] != file_count
       message = "Bottle publish failed: expected #{file_count} bottles, but published #{json["files"]} instead."
@@ -86,19 +99,26 @@ class Bintray
     end
 
     odebug "Published #{json["files"]} bottles"
-    result
   end
 
+  sig { params(org: T.nilable(String)).returns(T::Boolean) }
   def official_org?(org: @bintray_org)
     %w[homebrew linuxbrew].include? org
   end
 
+  sig { params(url: String).returns(T::Boolean) }
   def stable_mirrored?(url)
     headers, = curl_output("--connect-timeout", "15", "--location", "--head", url)
     status_code = headers.scan(%r{^HTTP/.* (\d+)}).last.first
     status_code.start_with?("2")
   end
 
+  sig do
+    params(formula:         Formula,
+           repo:            String,
+           publish_package: T::Boolean,
+           warn_on_error:   T::Boolean).returns(String)
+  end
   def mirror_formula(formula, repo: "mirror", publish_package: false, warn_on_error: false)
     package = Utils::Bottles::Bintray.package formula.name
 
@@ -129,18 +149,19 @@ class Bintray
     destination_url
   end
 
-  def create_package(repo:, package:, **extra_data_args)
+  sig { params(repo: String, package: String).void }
+  def create_package(repo:, package:)
     url = "#{API_URL}/packages/#{@bintray_org}/#{repo}"
     data = { name: package, public_download_numbers: true }
     data[:public_stats] = official_org?
-    data.merge! extra_data_args
-    open_api url, "--header", "Content-Type: application/json", "--request", "POST", "--data", data.to_json
+    open_api(url, "--header", "Content-Type: application/json", "--request", "POST", "--data", data.to_json)
   end
 
+  sig { params(repo: String, package: String).returns(T::Boolean) }
   def package_exists?(repo:, package:)
     url = "#{API_URL}/packages/#{@bintray_org}/#{repo}/#{package}"
     begin
-      open_api url, "--fail", "--silent", "--output", "/dev/null", auth: false
+      open_api(url, "--fail", "--silent", "--output", "/dev/null", auth: false)
     rescue ErrorDuringExecution => e
       stderr = e.output
                 .select { |type,| type == :stderr }
@@ -156,8 +177,8 @@ class Bintray
 
   # Gets the SHA-256 checksum of the specified remote file.
   #
-  # @return the empty string if the file exists but doesn't have a checksum.
-  # @return [nil] if the file doesn't exist.
+  # @return the checksum, the empty string (if the file doesn't have a checksum), nil (if the file doesn't exist)
+  sig { params(repo: String, remote_file: String).returns(T.nilable(String)) }
   def remote_checksum(repo:, remote_file:)
     url = "https://dl.bintray.com/#{@bintray_org}/#{repo}/#{remote_file}"
     result = curl_output "--fail", "--silent", "--head", url
@@ -170,6 +191,7 @@ class Bintray
     end
   end
 
+  sig { params(bintray_repo: String, bintray_package: String, filename: String).returns(String) }
   def file_delete_instructions(bintray_repo, bintray_package, filename)
     <<~EOS
       Remove this file manually in your web browser:
@@ -180,6 +202,11 @@ class Bintray
     EOS
   end
 
+  sig do
+    params(bottles_hash:    T::Hash[String, T.untyped],
+           publish_package: T::Boolean,
+           warn_on_error:   T.nilable(T::Boolean)).void
+  end
   def upload_bottles(bottles_hash, publish_package: false, warn_on_error: false)
     formula_packaged = {}
 
diff --git a/Library/Homebrew/system_command.rb b/Library/Homebrew/system_command.rb
index d00d934895..289d907e98 100644
--- a/Library/Homebrew/system_command.rb
+++ b/Library/Homebrew/system_command.rb
@@ -75,7 +75,7 @@ class SystemCommand
       print_stdout: T::Boolean,
       print_stderr: T::Boolean,
       verbose:      T::Boolean,
-      secrets:      T::Array[String],
+      secrets:      T.any(String, T::Array[String]),
       chdir:        T.any(String, Pathname),
     ).void
   end
diff --git a/Library/Homebrew/tap.rb b/Library/Homebrew/tap.rb
index 0022617249..c45f6d09a9 100644
--- a/Library/Homebrew/tap.rb
+++ b/Library/Homebrew/tap.rb
@@ -632,7 +632,7 @@ class Tap
     end
   end
 
-  sig { params(file: Pathname).returns(Hash) }
+  sig { params(file: Pathname).returns(T.any(T::Array[String], Hash)) }
   def read_formula_list(file)
     JSON.parse file.read
   rescue JSON::ParserError