diff --git a/Library/Homebrew/attestation.rb b/Library/Homebrew/attestation.rb index 4ec51c2871..1c6a441f48 100644 --- a/Library/Homebrew/attestation.rb +++ b/Library/Homebrew/attestation.rb @@ -40,6 +40,16 @@ module Homebrew # @api private class GhAuthNeeded < RuntimeError; end + # Returns whether attestation verification is enabled. + # + # @api private + sig { returns(T::Boolean) } + def self.enabled? + Homebrew::EnvConfig.verify_attestations? \ + || Homebrew::EnvConfig.developer? \ + || Homebrew::Settings.read("devcmdrun") == "true" + end + # Returns a path to a suitable `gh` executable for attestation verification. # # @api private diff --git a/Library/Homebrew/formula_installer.rb b/Library/Homebrew/formula_installer.rb index 1d00a0a0d4..f2faedbe29 100644 --- a/Library/Homebrew/formula_installer.rb +++ b/Library/Homebrew/formula_installer.rb @@ -1258,7 +1258,7 @@ on_request: installed_on_request?, options:) def pour # We skip `gh` to avoid a bootstrapping cycle, in the off-chance a user attempts # to explicitly `brew install gh` without already having a version for bootstrapping. - if Homebrew::EnvConfig.verify_attestations? && formula.tap&.core_tap? && formula.name != "gh" + if Homebrew::Attestation.enabled? && formula.tap&.core_tap? && formula.name != "gh" ohai "Verifying attestation for #{formula.name}" begin Homebrew::Attestation.check_core_attestation formula.bottle