admin/brew
1
0
Fork 0
Code Issues Packages Projects Releases 6 Wiki Activity
40,980 Commits 15 Branches 471 Tags
Commit Graph

45 Commits

Author SHA1 Message Date
Nanda H Krishna
45f853ef61
Merge pull request #17793 from Homebrew/fix-frozen-array-modification-errors 
Avoid frozen array errors in `brew upgrade`
 2024-07-19 09:58:57 -04:00
apainintheneck
52cf4e30fc Share attestation formula sorting and gh exe checking logic 
This adds a new method to either move the `gh` formula to the front
of the formula list to be installed or checks that the `gh` formula
is already installed some other way.
 2024-07-18 21:32:50 -07:00
William Woodruff
493450a3ac
attestation: fix comment 
Signed-off-by: William Woodruff <william@yossarian.net>
 2024-07-18 12:06:37 -04:00
Bo Anderson
16d547b030
attestation: handle bad configurations better 2024-07-18 16:11:25 +01:00
Nanda H Krishna
6db608f43f
Ensure that the gh formula is sufficiently new 2024-07-17 14:48:53 -04:00
Nanda H Krishna
8839ccfe72
Fix tests for attestations 2024-07-17 14:48:53 -04:00
Nanda H Krishna
d2d814414e
cmd/{install,reinstall,upgrade}: ensure that gh is installed 2024-07-17 14:48:52 -04:00
Nanda H Krishna
51ec743d6f
Remove ensure_gh_installed! 
Co-authored-by: William Woodruff <william@yossarian.net>
 2024-07-17 14:48:52 -04:00
Nanda H Krishna
802eb54e87
Fix tests for attestations 2024-07-17 14:48:50 -04:00
Nanda H Krishna
4d387d285e
Fix type and style errors 2024-07-17 14:46:59 -04:00
Nanda H Krishna
3bb91601fb
Ensure early installation of gh for attestations 2024-07-17 14:46:58 -04:00
Bo Anderson
f40330c42d
attestation: avoid touching working directory 2024-07-17 19:18:09 +01:00
William Woodruff
ad1500ad60
Apply suggestions from code review 2024-07-14 16:30:12 -04:00
Nanda H Krishna
1ae21d2731
attestation: improve error message when gh is too old 2024-07-14 16:12:56 -04:00
Mike McQuaid
b8ff4b3d23
Widen attestation verification rollout 
Take 2 of https://github.com/Homebrew/brew/pull/17692 but with:

- provide and document `HOMEBREW_NO_VERIFY_ATTESTATIONS`
- don't try to run unless there's GitHub credentials
- don't try to run unless `gh` is installed
- don't try to run in CI

While we're here:
- split out a `Homebrew::EnvConfig.devcmdrun?` helper method
- add some missing `Homebrew::EnvConfig.github_api_token` presence
  checks
 2024-07-14 11:50:57 -04:00
Patrick Linnane
99b278b66b
brew style --fix 
Signed-off-by: Patrick Linnane <patrick@linnane.io>
 2024-07-13 14:58:07 -07:00
Mike McQuaid
5771c2f968
attestation: only enable for developers outside CI 
Let's hold off on CI and devcmdrun for now.
 2024-07-13 17:55:44 -04:00
Mike McQuaid
4366ade990
attestation: allow disabling verification. 
Add the (for now undocumented) `HOMEBREW_NO_VERIFY_ATTESTATIONS` to
disable attestation verification if it's having issues or when doing
development.

While we're here, do a little style cleanup too.
 2024-07-13 17:39:40 -04:00
William Woodruff
6cfe118ae3
attestation: don't dupe stderr 
Silences `system_command!`'s own stderr handling,
since we do it independently.

Signed-off-by: William Woodruff <william@yossarian.net>
 2024-07-13 15:30:21 -04:00
William Woodruff
570cf65523
attestations: widen the beta 
This widens the beta to include people with developer mode enabled,
as well as those with HOMEBREW_DEVELOPER set in their environment.

Signed-off-by: William Woodruff <william@yossarian.net>
 2024-07-13 10:51:49 -04:00
Mike McQuaid
c13700af00
Use repository consistently instead of repo 
The documentation linting job doesn't like `repo` so let's fix this
globally rather than naming it differently in documentation and code.
 2024-06-10 09:31:53 +01:00
William Woodruff
e0179350fe
attestation: rename loop var to please sorbet 
Signed-off-by: William Woodruff <william@yossarian.net>
 2024-06-06 11:41:21 -04:00
William Woodruff
8d0e6eafc3
attestation: handle :all bottles 
Signed-off-by: William Woodruff <william@yossarian.net>
 2024-06-06 11:23:03 -04:00
William Woodruff
3319e9956d
attestation: drop workflow check on core attestation 
Signed-off-by: William Woodruff <william@yossarian.net>
 2024-05-18 10:04:53 -04:00
William Woodruff
f78a8882d9
attestation: redact secret in environment 
Signed-off-by: William Woodruff <william@yossarian.net>
 2024-05-14 14:32:23 -04:00
Mike McQuaid
3d31594e39
Merge pull request #17220 from woodruffw-forks/ww/refine-gh-auth 
attestations: improve authentication techniques
 2024-05-06 08:38:07 +01:00
William Woodruff
18a8b12f7a
attestations: improve authentication techniques 
Signed-off-by: William Woodruff <william@yossarian.net>
 2024-05-03 12:37:01 -04:00
Markus Reiter
caf87c0336
Warn about undocumented non-private APIs. 2024-05-01 11:35:20 +02:00
Joseph Sweeney
3ccc6b2521 fixup comment 2024-04-30 10:52:36 -04:00
Joseph Sweeney
9fff688bbe Make comment more explicit 2024-04-30 10:51:11 -04:00
Joseph Sweeney
883c1e9907 Update attestation tests 2024-04-30 10:16:57 -04:00
Joseph Sweeney
0f5d19220c Add comment explaining lack of signing workflow 2024-04-30 10:10:43 -04:00
Joseph Sweeney
65a90582b4 Remove a flag for backfill attestation checks 
Some backfilled bottle signatures were signed from a branch, and others
from main, so the signing workflow is slightly different which causes
some bottles to incorrectly fail when checking their attestation (apr
for example). The simplest way to solve this is just removing the
backfill repo `cert-identity` check and just rely on the repository and
attestation date falling before our cutoff. This shouldn't meaningfully
affect security because if somehow someone could generate false backfill
attestations from a different workflow (the only case this protects
against), we will still catch it because the attestation would have been
generated after our cutoff date.
 2024-04-30 09:52:04 -04:00
William Woodruff
faa00c8c79
handle backfilled attestation subjects correctly 
Signed-off-by: William Woodruff <william@yossarian.net>
 2024-04-11 16:44:57 -04:00
William Woodruff
e2b5d93198
more attestation coverage 
Signed-off-by: William Woodruff <william@yossarian.net>
 2024-04-11 13:39:13 -04:00
William Woodruff
990b7d77d6
attestation: fix a missing arg, add initial specs 
Signed-off-by: William Woodruff <william@yossarian.net>
 2024-04-10 17:57:01 -04:00
William Woodruff
6e10001d49
attestation: strict typechecking 
Signed-off-by: William Woodruff <william@yossarian.net>
 2024-04-09 11:03:41 -04:00
William Woodruff
2efef36313
move InvalidAttestationError into Attestation mod 
Signed-off-by: William Woodruff <william@yossarian.net>
 2024-04-09 10:52:48 -04:00
William Woodruff
5ec3dab141
attestation: document BACKFILL_CUTOFF better 
Signed-off-by: William Woodruff <william@yossarian.net>
 2024-04-09 10:50:49 -04:00
William Woodruff
a3a5f78de3
attestation: document gh_executable bootstrap cycle 
Signed-off-by: William Woodruff <william@yossarian.net>
 2024-04-09 10:48:17 -04:00
William Woodruff
e52c253832
attestation: simplify gh bootstrapping 
Signed-off-by: William Woodruff <william@yossarian.net>
 2024-04-09 10:45:44 -04:00
William Woodruff
ca6db49859
Apply suggestions from code review 
Co-authored-by: Mike McQuaid <mike@mikemcquaid.com>
 2024-04-09 10:18:08 -04:00
William Woodruff
1881a1f4bc
attestation: more docs 
Signed-off-by: William Woodruff <william@yossarian.net>
 2024-04-08 16:22:57 -04:00
William Woodruff
578c2bc9da
rubocop fixes 
Signed-off-by: William Woodruff <william@yossarian.net>
 2024-04-08 16:21:31 -04:00
William Woodruff
48e39bb51d
attestation: add initial attestation helpers 
Adds the basic attestation verification APIs, as well
as a pre-pour check against `HOMEBREW_VERIFY_ATTESTATIONS`
that verifies the attestation (or backfill as necessary)
for bottles from homebrew-core.

Signed-off-by: William Woodruff <william@yossarian.net>
 2024-04-08 16:18:15 -04:00