From 0cdecdbebc0b58d082141971fc760bbd8c331553 Mon Sep 17 00:00:00 2001 From: Gnani Rahul Date: Sat, 11 Jul 2026 16:28:11 -0500 Subject: [PATCH] docs: add formula-scoped Homebrew trust GSTACK-Checkpoint: 2026-07-11/slice-p-release-supply-chain#5 Signed-off-by: Gnani Rahul --- README.md | 5 +++++ docs/RELEASE.md | 5 +++++ .../2026-07-11-slice-p-release-supply-chain.md | 3 +++ tools/internal/releasepack/policy_test.go | 14 ++++++++++++++ 4 files changed, 27 insertions(+) diff --git a/README.md b/README.md index 2dca41b..c67a925 100644 --- a/README.md +++ b/README.md @@ -20,10 +20,15 @@ On macOS or Linux with Homebrew: ```bash brew tap ArdurAI/tap +brew trust --formula ArdurAI/tap/sith brew install sith sith version ``` +Homebrew 6 requires explicit trust for third-party taps. The formula-scoped command keeps the trust +boundary narrower than trusting every current and future formula in `ArdurAI/tap`. Older Homebrew +versions that do not implement tap trust can omit that line. + Release archives are also available for `darwin/amd64`, `darwin/arm64`, `linux/amd64`, and `linux/arm64`. Every archive has a checksum, an SPDX SBOM, a keyless Sigstore bundle, SLSA build provenance, and a platform-specific SBOM attestation. Verify those materials before installing; diff --git a/docs/RELEASE.md b/docs/RELEASE.md index 1358ea7..6967288 100644 --- a/docs/RELEASE.md +++ b/docs/RELEASE.md @@ -14,10 +14,15 @@ The workflow follows the primary guidance for [GitHub artifact attestations](htt ```bash brew tap ArdurAI/tap +brew trust --formula ArdurAI/tap/sith brew install sith sith version --output json ``` +Homebrew 6 requires explicit trust for third-party taps. Trust only the Sith formula as shown; do +not disable tap trust or broaden it to the whole tap. Older Homebrew releases without tap trust can +omit the `brew trust` command. + The tap formula is generated from the release checksum manifest; it does not carry hand-entered URLs or hashes. The release workflow signs the formula itself. The tap's own repository automation verifies that signature and the signed checksum manifest before importing the formula, so the Sith diff --git a/sessions/2026-07-11-slice-p-release-supply-chain.md b/sessions/2026-07-11-slice-p-release-supply-chain.md index 6ee3aa5..356d42f 100644 --- a/sessions/2026-07-11-slice-p-release-supply-chain.md +++ b/sessions/2026-07-11-slice-p-release-supply-chain.md @@ -23,6 +23,9 @@ [A] Action: Two hosted unit/race runs exceeded the TUI microbenchmark's race-only allowance while repeated local runs and the dedicated non-race performance gate passed. Removed the invalid race-instrumented wall-clock assertion; the same test still enforces the unchanged 100 ms p95 budget through `make perf`. [T] Test: Race-targeted invocation skips only the latency microbenchmark; non-race `make perf` runs and passes the 100 ms acceptance test. All functional race coverage remains in the unit gate. [C] Checkpoint #4: isolate performance acceptance from race instrumentation — next: green remote gates and documentation promotion. +[A] Action: Homebrew 6 consumer testing showed that third-party taps require explicit trust before install. Added the formula-scoped `brew trust --formula ArdurAI/tap/sith` command to Sith and tap install guidance and their regression/CI checks; explicitly rejected whole-tap trust and the unsafe trust-disable environment override. +[T] Test: The exact tap → formula trust → `brew install sith` → `brew test` path passes against the public ArdurAI tap. The installed binary reports v0.1.0, commit 5e50168315787f864127349556e36c46d8872bd5, Go 1.26.5, and darwin/arm64; cleanup removes the local install and tap. +[C] Checkpoint #5: Homebrew 6 formula-scoped trust UX — next: promote corrected guidance and close Phase-L release evidence. --- diff --git a/tools/internal/releasepack/policy_test.go b/tools/internal/releasepack/policy_test.go index 3a0531f..d755f12 100644 --- a/tools/internal/releasepack/policy_test.go +++ b/tools/internal/releasepack/policy_test.go @@ -88,6 +88,20 @@ func TestReleaseGuidePinsSPDXPredicateVersion(t *testing.T) { } } +func TestInstallDocsUseFormulaScopedHomebrewTrust(t *testing.T) { + t.Parallel() + root := repositoryRoot(t) + for _, name := range []string{"README.md", "docs/RELEASE.md"} { + contents := readRepositoryFile(t, root, name) + if !strings.Contains(contents, "brew trust --formula ArdurAI/tap/sith") { + t.Errorf("%s does not require formula-scoped Homebrew trust", name) + } + if strings.Contains(contents, "brew trust ArdurAI/tap") { + t.Errorf("%s broadens trust to the entire Homebrew tap", name) + } + } +} + func repositoryRoot(t *testing.T) string { t.Helper() _, filename, _, ok := runtime.Caller(0)