From 4ade9351e418dac599acffc93d6b00c899cb1b26 Mon Sep 17 00:00:00 2001
From: Clint Harrison <clint@stripe.com>
Date: Tue, 15 Aug 2023 11:29:02 +0100
Subject: [PATCH] Allow HOMEBREW_CURLRC to provide a path for curl --config

Co-authored-by: Mike McQuaid <mike@mikemcquaid.com>
Co-authored-by: Carlo Cabrera <30379873+carlocab@users.noreply.github.com>
---
 Library/Homebrew/env_config.rb           |  7 ++++---
 Library/Homebrew/env_config.rbi          |  4 ++--
 Library/Homebrew/test/utils/curl_spec.rb | 18 +++++++++++++++++-
 Library/Homebrew/utils/curl.rb           | 11 ++++++++++-
 docs/Manpage.md                          |  2 +-
 manpages/brew.1                          |  2 +-
 6 files changed, 35 insertions(+), 9 deletions(-)

diff --git a/Library/Homebrew/env_config.rb b/Library/Homebrew/env_config.rb
index b3784b8711..5bf6cc03d5 100644
--- a/Library/Homebrew/env_config.rb
+++ b/Library/Homebrew/env_config.rb
@@ -132,9 +132,10 @@ module Homebrew
         boolean:     true,
       },
       HOMEBREW_CURLRC:                           {
-        description: "If set, do not pass `--disable` when invoking `curl`(1), which disables the " \
-                     "use of `curlrc`.",
-        boolean:     true,
+        description: "If set to an absolute path (i.e. beginning with `/`), pass it with `--config` when invoking " \
+                     "`curl`(1). " \
+                     "If set but _not_ a valid path, do not pass `--disable`, which disables the " \
+                     "use of `.curlrc`.",
       },
       HOMEBREW_DEBUG:                            {
         description: "If set, always assume `--debug` when running commands.",
diff --git a/Library/Homebrew/env_config.rbi b/Library/Homebrew/env_config.rbi
index 533d514b36..b61b8e519d 100644
--- a/Library/Homebrew/env_config.rbi
+++ b/Library/Homebrew/env_config.rbi
@@ -67,8 +67,8 @@ module Homebrew::EnvConfig
   sig { returns(T::Boolean) }
   def self.curl_verbose?; end
 
-  sig { returns(T::Boolean) }
-  def self.curlrc?; end
+  sig { returns(T.nilable(String)) }
+  def self.curlrc; end
 
   sig { returns(T::Boolean) }
   def self.debug?; end
diff --git a/Library/Homebrew/test/utils/curl_spec.rb b/Library/Homebrew/test/utils/curl_spec.rb
index 1a72ce525c..cbbe43b806 100644
--- a/Library/Homebrew/test/utils/curl_spec.rb
+++ b/Library/Homebrew/test/utils/curl_spec.rb
@@ -313,11 +313,27 @@ describe "Utils::Curl" do
       expect(curl_args(*args).first).to eq("--disable")
     end
 
-    it "doesn't return `--disable` as the first argument when HOMEBREW_CURLRC is set" do
+    it "doesn't return `--disable` as the first argument when HOMEBREW_CURLRC is set but not a path" do
       ENV["HOMEBREW_CURLRC"] = "1"
       expect(curl_args(*args).first).not_to eq("--disable")
     end
 
+    it "doesn't return `--config` when HOMEBREW_CURLRC is unset" do
+      expect(curl_args(*args)).not_to include(a_string_starting_with("--config"))
+    end
+
+    it "returns `--config` when HOMEBREW_CURLRC is a valid path" do
+      Tempfile.create do |tmpfile|
+        path = tmpfile.path
+        ENV["HOMEBREW_CURLRC"] = path
+        # We still expect --disable
+        expect(curl_args(*args).first).to eq("--disable")
+        expect(curl_args(*args).join(" ")).to include("--config #{path}")
+      end
+    ensure
+      ENV["HOMEBREW_CURLRC"] = nil
+    end
+
     it "uses `--connect-timeout` when `:connect_timeout` is Numeric" do
       expect(curl_args(*args, connect_timeout: 123).join(" ")).to include("--connect-timeout 123")
       expect(curl_args(*args, connect_timeout: 123.4).join(" ")).to include("--connect-timeout 123.4")
diff --git a/Library/Homebrew/utils/curl.rb b/Library/Homebrew/utils/curl.rb
index d480c0ef7b..0831d2e3cf 100644
--- a/Library/Homebrew/utils/curl.rb
+++ b/Library/Homebrew/utils/curl.rb
@@ -71,7 +71,16 @@ module Utils
       args = []
 
       # do not load .curlrc unless requested (must be the first argument)
-      args << "--disable" unless Homebrew::EnvConfig.curlrc?
+      curlrc = Homebrew::EnvConfig.curlrc
+      if curlrc&.start_with?("/")
+        # If the file exists, we still want to disable loading the default curlrc.
+        args << "--disable" << "--config" << curlrc
+      elsif curlrc
+        # This matches legacy behavior: `HOMEBREW_CURLRC` was a bool,
+        # omitting `--disable` when present.
+      else
+        args << "--disable"
+      end
 
       # echo any cookies received on a redirect
       args << "--cookie" << "/dev/null"
diff --git a/docs/Manpage.md b/docs/Manpage.md
index 8ebbe03535..2d3f11a6f1 100644
--- a/docs/Manpage.md
+++ b/docs/Manpage.md
@@ -2176,7 +2176,7 @@ prefix-specific files take precedence over system-wide files (unless
   <br>If set, pass `--verbose` when invoking `curl`(1).
 
 - `HOMEBREW_CURLRC`
-  <br>If set, do not pass `--disable` when invoking `curl`(1), which disables the use of `curlrc`.
+  <br>If set to an absolute path (i.e. beginning with `/`), pass it with `--config` when invoking `curl`(1). If set but _not_ a valid path, do not pass `--disable`, which disables the use of `.curlrc`.
 
 - `HOMEBREW_DEBUG`
   <br>If set, always assume `--debug` when running commands.
diff --git a/manpages/brew.1 b/manpages/brew.1
index 9025aad9ae..1c8b2a9092 100644
--- a/manpages/brew.1
+++ b/manpages/brew.1
@@ -3149,7 +3149,7 @@ If set, pass \fB\-\-verbose\fR when invoking \fBcurl\fR(1)\.
 \fBHOMEBREW_CURLRC\fR
 .
 .br
-If set, do not pass \fB\-\-disable\fR when invoking \fBcurl\fR(1), which disables the use of \fBcurlrc\fR\.
+If set to an absolute path (i\.e\. beginning with \fB/\fR), pass it with \fB\-\-config\fR when invoking \fBcurl\fR(1)\. If set but \fInot\fR a valid path, do not pass \fB\-\-disable\fR, which disables the use of \fB\.curlrc\fR\.
 .
 .TP
 \fBHOMEBREW_DEBUG\fR