Attest supported third-party tap bottles by heaths · Pull Request #23769 · Homebrew/brew

heaths · 2026-09-04T09:40:26Z

Extend bottle attestation verification beyond homebrew/core, add attesting publish workflows to brew tap-new by default with a --no-attestations opt-out, and update tests and documentation for the new third-party tap support.

This allows third-party taps to be verified if they also attest their bottles. Per a previous discussion, it sounded like verifying third-party taps wasn't supported only due to lack of request or contributions. I've been trying to attest all my binaries but need brew to verify bottles since binaries may be modified even on the host machine, I was told.

Have you followed our Contributing guidelines?
Have you checked for other open Pull Requests for the same change?
Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
Have you explained why you'd like these changes included, not just what they do?
For bug fixes, have you given step-by-step brew commands to reproduce the bug?
Have you written new tests (excluding integration tests)? Here's an example.
Have you successfully run brew lgtm (style, typechecking and tests) locally?

I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

I did use gpt-5.4 to find relevant code initially but then read through the code to come up with a design and high-level plan, then again to write initial code, but everything was reviewed and code context around changes was considered. I also ran manual tests including rev'ing a formula in my tap after updating my workflow to include the attestation step (and required permissions) in the workflow template in this PR.

Test PR: heaths/homebrew-tap#29. I found an issue because the bottle tarballs were in a temp directory and not available to attest. Passing the bottle_path from the pull_bottles step fixes that, and brew verify <formula> works:

$ ./bin/brew verify akv --debug -v
/Users/heaths/src/brew/Library/Homebrew/brew.rb (Formulary::FromNameLoader): loading akv
==> Downloading https://ghcr.io/v2/heaths/tap/akv/blobs/sha256:350d4014901f4cd99b50e2e7a9f16167c3136b6e75fb154c509c2bdfbf844302
Already downloaded: /Users/heaths/Library/Caches/Homebrew/downloads/d3fcd81614b75efffe78a303a11717896c424a24a8f64b36d1babb22aa8efea7--akv--1.0.0_3.arm64_sequoia.bottle.tar.gz
==> Verifying checksum for 'd3fcd81614b75efffe78a303a11717896c424a24a8f64b36d1babb22aa8efea7--akv--1.0.0_3.arm64_sequoia.bottle.tar.gz'
/usr/bin/env PATH=/Users/heaths/src/brew/opt/gh/bin:/Users/heaths/src/brew/Library/Homebrew/shims/shared:/usr/bin:/bin:/usr/sbin:/sbin HOME=/Users/heaths gh auth token --hostname github.com
/usr/bin/env HOME=/Users/heaths git credential-osxkeychain get
/usr/bin/env GH_TOKEN=****** GH_HOST=github.com /opt/homebrew/bin/gh attestation verify /Users/heaths/Library/Caches/Homebrew/downloads/d3fcd81614b75efffe78a303a11717896c424a24a8f64b36d1babb22aa8efea7--akv--1.0.0_3.arm64_sequoia.bottle.tar.gz --repo heaths/homebrew-tap --format json
==> akv--1.0.0_3.arm64_sequoia.bottle.tar.gz has a valid attestation

Extend bottle attestation verification beyond homebrew/core, add attesting publish workflows to brew tap-new by default with a --no-attestations opt-out, and update tests and documentation for the new third-party tap support.

github-actions · 2026-09-04T09:40:37Z

Thanks for your pull request. This has been closed because it appears to be missing the pull request template, perhaps because this was written by an AI not a human. We require humans to read and fill in these templates.

Please edit this pull request to fill in the current pull request template. This workflow will reopen this pull request automatically once the template is complete. Do not open a new pull request for this.

heaths · 2026-09-04T09:41:25Z

Actually, I created it using `gh pr create' but I'll fill out the template.

Copilot

Copilot review overview

🟡 Changes recommended

The generated publish workflow deletes its bottle directory before the new attestation step can access the artifacts.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1 · 1

New issues introduced by this change (2)

Severity	Finding
	`.github/workflows/tap-new-publish.yml` — The attestation step cannot see the bottles: `brew pr-pull` creates them under a temporary…
	`docs/Homebrew-Security-and-Supply-Chain.md` — These two lines each contain two sentences, contrary to the docs convention requiring one sentence…

What changed in this PR

Extends bottle attestation support to eligible third-party taps and enables attestations in newly generated tap workflows.

Changes:

Resolves expected attestation repositories from formula taps.
Adds third-party verification handling and tests.
Generates attesting publish workflows with an opt-out flag.

File	Description
`.github/workflows/tap-new-publish.yml`	Adds bottle attestation generation.
`Library/Homebrew/attestation.rb`	Resolves and verifies tap attestations.
`Library/Homebrew/dev-cmd/tap-new.rb`	Adds attestation workflow configuration.
`Library/Homebrew/dev-cmd/verify.rb`	Verifies third-party bottles.
`Library/Homebrew/env_config.rb`	Updates environment descriptions.
`Library/Homebrew/formula_installer.rb`	Enables third-party verification.
`Library/Homebrew/sorbet/rbi/dsl/homebrew/dev_cmd/tap_new.rbi`	Types the new option.
`Library/Homebrew/utils/attestation.rb`	Handles unsupported taps.
`Library/Homebrew/test/attestation_spec.rb`	Tests tap repository resolution.
`Library/Homebrew/test/dev-cmd/tap-new_spec.rb`	Tests workflow generation and opt-out.
`Library/Homebrew/test/dev-cmd/verify_spec.rb`	Tests third-party verification.
`Library/Homebrew/test/formula_installer_spec.rb`	Tests verification enqueueing.
`completions/bash/brew`	Adds Bash completion.
`completions/fish/brew.fish`	Adds fish completion.
`completions/zsh/_brew`	Adds zsh completion.
`docs/Homebrew-Security-and-Supply-Chain.md`	Documents third-party attestations.
`docs/Manpage.md`	Updates generated command documentation.
`manpages/brew.1`	Updates generated manpage content.

Files not reviewed (1)

Library/Homebrew/sorbet/rbi/dsl/homebrew/dev_cmd/tap_new.rbi: File type not supported

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

MikeMcQuaid

Thanks @heaths; great work and looking good so far. A few questions and comments but we're pretty close already.

MikeMcQuaid · 2026-09-04T11:17:34Z

+      # tap-new-attestations-start
+      attestations: write
+      # tap-new-attestations-end
      checks: read
      contents: write
+      # tap-new-attestations-start
+      id-token: write
+      # tap-new-attestations-end


A comment above the comment explaining this and grouping both of these into a single block would be preferable

MikeMcQuaid · 2026-09-04T11:24:52Z

+        switch "--no-attestations",
+               description: "Do not include GitHub Artifact Attestations in generated workflows."


wondering when/why you'd want to do this. any downsides of just having them always enabled for everyone?

MikeMcQuaid · 2026-09-04T11:25:27Z

          Verify the build provenance of bottles using GitHub's attestation tools.
          This is done by first fetching the given bottles and then verifying
-          their provenance.
+          their provenance for `homebrew/core` and supported third-party taps.


Suggested change

their provenance for `homebrew/core` and supported third-party taps.

their provenance for `homebrew/core` and third-party taps that provide attestations.

MikeMcQuaid · 2026-09-04T11:25:58Z

    ATTESTATION_MAX_RETRIES = 5

+    sig { params(bottle: Bottle).returns(T.nilable(Formula)) }
+    def self.formula_for_bottle(bottle)


please inline any new methods used only once

Attest supported third-party tap bottles

379ed35

Extend bottle attestation verification beyond homebrew/core, add attesting publish workflows to brew tap-new by default with a --no-attestations opt-out, and update tests and documentation for the new third-party tap support.

Copilot AI balanced review requested due to automatic review settings September 4, 2026 09:40

github-actions Bot closed this Sep 4, 2026

Copilot started reviewing on behalf of heaths September 4, 2026 09:40 View session

Copilot AI reviewed Sep 4, 2026

View reviewed changes

Comment thread .github/workflows/tap-new-publish.yml Outdated

Comment thread docs/Homebrew-Security-and-Supply-Chain.md Outdated

github-actions Bot reopened this Sep 4, 2026

heaths marked this pull request as draft September 4, 2026 10:16

heaths and others added 2 commits September 4, 2026 04:09

Fix documentation style

c9907af

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Retain bottles and pass path to attestation step

684a20e

heaths marked this pull request as ready for review September 4, 2026 11:16

MikeMcQuaid reviewed Sep 4, 2026

View reviewed changes

Navigation Menu

Uh oh!

Uh oh!

Attest supported third-party tap bottles - #23769

Attest supported third-party tap bottles#23769
heaths wants to merge 3 commits into
Homebrew:mainfrom
heaths:verify-external-taps

heaths commented Sep 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

heaths commented Sep 4, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

MikeMcQuaid left a comment

Uh oh!

MikeMcQuaid Sep 4, 2026

Uh oh!

MikeMcQuaid Sep 4, 2026

Uh oh!

MikeMcQuaid Sep 4, 2026

Uh oh!

MikeMcQuaid Sep 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		switch "--no-attestations",
		description: "Do not include GitHub Artifact Attestations in generated workflows."

	their provenance for `homebrew/core` and supported third-party taps.
	their provenance for `homebrew/core` and third-party taps that provide attestations.

Uh oh!

Uh oh!

Conversation

heaths commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

heaths commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

MikeMcQuaid left a comment

Choose a reason for hiding this comment

Uh oh!

MikeMcQuaid Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

MikeMcQuaid Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

MikeMcQuaid Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

MikeMcQuaid Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

heaths commented Sep 4, 2026 •

edited

Loading

heaths commented Sep 4, 2026 •

edited

Loading