diff --git a/Library/Homebrew/cask/audit.rb b/Library/Homebrew/cask/audit.rb index e27a04ca0f..3d8feb3c54 100644 --- a/Library/Homebrew/cask/audit.rb +++ b/Library/Homebrew/cask/audit.rb @@ -4,6 +4,7 @@ require "cask/denylist" require "cask/download" require "cask/installer" +require "cask/quarantine" require "digest" require "livecheck/livecheck" require "source_location" @@ -501,6 +502,11 @@ module Cask return if !cask.tap.official? && !signing? return if cask.deprecated? && cask.deprecation_reason != :unsigned + unless Quarantine.available? + odebug "Quarantine support is not available, skipping signing audit" + return + end + odebug "Auditing signing" is_in_skiplist = cask.tap&.audit_exception(:signing_audit_skiplist, cask.token) @@ -515,6 +521,11 @@ module Cask path = tmpdir/artifact_path.relative_path_from(cask.staged_path) + unless Quarantine.detect(path) + odebug "#{path} does not have quarantine attributes, skipping signing audit" + next false + end + result = case artifact when Artifact::Pkg system_command("spctl", args: ["--assess", "--type", "install", path], print_stderr: false) diff --git a/Library/Homebrew/test/cask/audit_spec.rb b/Library/Homebrew/test/cask/audit_spec.rb index 04f52dc4de..7ee1cf489c 100644 --- a/Library/Homebrew/test/cask/audit_spec.rb +++ b/Library/Homebrew/test/cask/audit_spec.rb @@ -453,6 +453,7 @@ RSpec.describe Cask::Audit, :cask do describe "signing checks" do let(:only) { ["signing"] } + let(:tap) { CoreCaskTap.instance } let(:download_double) { instance_double(Cask::Download) } let(:unpack_double) { instance_double(UnpackStrategy::Zip) } @@ -495,6 +496,31 @@ RSpec.describe Cask::Audit, :cask do expect(run).not_to error_with(/Audit\.app/) end end + + context "when quarantine support is not available" do + let(:cask) do + tmp_cask "signing-cask-test", <<~RUBY + cask 'signing-cask-test' do + version '1.0' + url "https://brew.sh/" + app 'Audit.app' + end + RUBY + end + + before do + allow(cask).to receive(:tap).and_return(tap) + + allow(Cask::Quarantine).to receive(:available?).and_return(false) + end + + it "skips signing audit with warning" do + allow(cask).to receive(:tap).and_return(tap) + + expect(audit).to receive(:odebug).with("Quarantine support is not available, skipping signing audit") + expect(run).not_to error_with(/Signature verification failed/) + end + end end describe "livecheck should be skipped", :no_api do