dev-cmd/audit: add audit for checksum

[bayandin]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes? Here's an example.
• Have you successfully run brew style with your changes locally?
• Have you successfully run brew tests with your changes locally?
• Have you successfully run brew man locally and committed any changes?

---

This PR make checksum mandatory for all curl downloadable resources to prevent cases like Homebrew/homebrew-core#66471 (comment) / Homebrew/homebrew-core#66481

[BrewTestBot]

Review period will end on 2020-12-09 at 22:53:17 UTC.

[BrewTestBot]

Review period ended.

[Rylan12]

Just a thought: do we want this to be enabled only for homebrew/core or for third-party taps as well?

I ask only because there have been a few instances in the past where audit/style changes have broke third-party taps in a way that isn't necessary.

Pros of restricting to homebrew/core:

• Gives third-party taps the ability to choose whether this requirement applies to their tap or not
• No change for third-party taps

Cons:

• I think that including the sha256 is a good idea anyway so, of all the things we could "force" third-party taps into doing, this seems totally reasonable
• Potential for causing issues where audit now fails for taps

---

I'm leaning toward not-restricting. I think this is such a fundamental part of the formula that it totally makes sense to require it for everyone (and those that don't want it for their taps can choose to ignore the audit). Just figured I'd raise the issue as we've (or, rather: I've) had a few issues with this in the past and I just want to make sure that we're being mindful of how our internal decisions can affect third-party taps.

[bayandin]

Good point @Rylan12, my initial thoughts about it were that since it's an audit, it shouldn't break the main use case brew install <formula>, it's possible to skip (with a bunch of other checks, but still) using brew audit --except=specs <formula> so it's ok to have it enabled by default for all taps.

Nevertheless, I can imagine some terribly insecure case when a third-party tap has bottle :unneeded-formula where it always points to the latest version (like https://github.com/User/repo/archive/master.tar.gz). But we shouldn't encourage such examples I believe.

[MikeMcQuaid]

I'm leaning toward not-restricting. I think this is such a fundamental part of the formula that it totally makes sense to require it for everyone (and those that don't want it for their taps can choose to ignore the audit).

Agreed, it's also a security risk not having it there so I'd say having a brew audit complain is pretty reasonable.

But we shouldn't encourage such examples I believe.

👍

[MikeMcQuaid]

Thanks @bayandin!